California suit says 23andMe hack exposed 855,000 Californians' genetic data

CALIFORNIA — California Attorney General Rob Bonta announced a lawsuit Thursday against genetic testing company 23andMe, now known as Chrome Holding Company, accusing the company of failing to protect millions of users’ sensitive genetic information during a massive 2023 data breach .

According to the lawsuit, the breach exposed the personal information of nearly 7 million users nationwide, including more than 855,000 Californians. State investigators say hackers were able to remain inside the company’s systems undetected for five months.

The complaint alleges 23andMe failed to implement basic cybersecurity protections and later misled customers the severity of the breach and the company’s responsibility for it.

FILE PHOTO — A lawsuit against genetic testing company 23andMe, now known as Chrome Holding Company, accuses the company of failing to protect millions of users’ sensitive genetic information during a massive 2023 data breach. (SBG)

Investigators say hackers used a cyberattack technique known as “credential stuffing,” which relies on stolen usernames and passwords from data breaches. According to the state, attackers used credentials exposed during an earlier breach involving MyHeritage, a genealogy company that had partnered with 23andMe.

Once inside customer accounts, investigators say hackers exploited a flaw in the company’s “DNA Relatives” feature to gain access to additional user information, including ancestry reports and genetic match data.

One of the most alarming details in the lawsuit involves how the stolen information was later marketed online. Bonta said the breach became public after data belonging to one million users was advertised for sale on the dark web, specifically identifying Asian American, Pacific Islander and Jewish users.

California Attorney General Rob Bonta announced a lawsuit Thursday against genetic testing company 23andMe, now known as Chrome Holding Company, accusing the company of failing to protect millions of users’ sensitive genetic information during a massive 2023 data breach. (DOJ)

The attorney general said the breach occurred during a period of rising anti-AAPI and antisemitic hate incidents across the country.

The lawsuit also accuses 23andMe of downplaying the breach publicly while privately negotiating with hackers and paying a $400,000 cryptocurrency ransom in exchange for the destruction of stolen data and information security vulnerabilities.

“Instead of protecting their customers, 23andMe left them vulnerable to an attack and then lied to consumers it,” Bonta said.

California alleges the company violated several state laws, including the Genetic Information Privacy Act, California Consumer Privacy Act, False Advertising Law and Unfair Competition Law.

The lawsuit is separate from an ongoing legal challenge involving the potential sale of Californians’ genetic data during 23andMe’s bankruptcy proceedings.

Report a correction or typo.