California Sues 23andMe Over Hack Exposing 855,000 Residents, Alleges $400,000 Ransom Payment
Updated
Updated · KRCR · May 28
California Sues 23andMe Over Hack Exposing 855,000 Residents, Alleges $400,000 Ransom Payment
3 articles · Updated · KRCR · May 28
Summary
855,000 Californians were exposed in a 2023 23andMe breach, and the state says hackers stayed inside the company’s systems undetected for about five months.
Credential-stuffing attacks using stolen logins from an earlier MyHeritage breach allegedly opened customer accounts, then a flaw in 23andMe’s DNA Relatives feature let attackers pull ancestry reports and genetic-match data.
California says 23andMe failed to implement basic safeguards, downplayed the breach publicly, and privately paid a $400,000 cryptocurrency ransom while negotiating with the hackers.
1 million users’ data was later advertised on the dark web, with listings specifically identifying Asian American, Pacific Islander and Jewish users, according to Attorney General Rob Bonta.
The suit alleges violations of California privacy, false advertising and unfair competition laws, separate from a fight over any sale of genetic data in 23andMe’s bankruptcy.
When hackers target DNA data by ethnicity, how can genetic testing companies guarantee the safety of vulnerable groups?
As states create a patchwork of privacy laws, is our most sensitive data truly safe nationwide?
23andMe’s 2023 Data Breach: 7 Million Genetic Profiles Exposed, Legal Fallout, and Industry Shakeup
Overview
In July 2025, TTAM Research Institute acquired 23andMe's assets after the latter's bankruptcy and data breach lawsuit settlement. This acquisition was designed to address 23andMe's legacy issues and set a new direction under TTAM's leadership. Importantly, the funds from the sale are expected to compensate all of 23andMe's creditors, including customers harmed by the data breach. By providing restitution and aiming to restore trust, the acquisition marks a pivotal step toward financial closure for those affected and signals a fresh start for the company and its stakeholders.