Cybersecurity Policy Report, Cybersecurity Failures Led to 23andMe Data Breach, AG Bonta Alleges in Lawsuit, (May 29, 2026)

By Tom Leithauser

23andMe violated California law by failing to protect its customers’ data and by misleading the public about a 2023 data breach that exposed the genetic data and other sensitive information of 7 million Americans, according to California Attorney General Rob Bonta (D.)

AG Bonta yesterday announced he was suing Chrome Holding Co., which now runs the 23andMe personal genomics service, in California Superior Court.

The hacker that breached 23andMe used a “credential stuffing” attack that could have been stopped if the company had an adequate cybersecurity program, and flaws in 23andMe’s cyber defenses enabled the cyber attacker to access other parts of the network and remain undetected for five months, according to the lawsuit.

“23andMe’s security measures were so lax that the threat actor was able to operate undetected within 23andMe’s systems for over five months, and remarkably, 23andMe only began investigating after the threat actor offered the stolen user data for sale on the dark web and reached out to 23andMe to demand a ransom,” the complaint says.

“While 23andMe publicly touted its commitment to data privacy and transparency, in truth it failed to take reasonable measures to protect its customers’ most sensitive data, ignored known vulnerabilities in its systems, and failed to properly investigate or respond to numerous warnings that its systems had been compromised, resulting in the unauthorized access to and disclosure of millions of customers’ data,” it says.

“It also misled its customers and the public regarding the adequacy of its data safeguards and crucial aspects of the resulting data breach,” the complaint adds.

“23andMe collected genetic data about millions of people, failed to meet its obligation under California law to keep that information safe, and then lied to consumers about the severity of its 2023 data breach. Our investigation found that the company failed to take basic steps to protect users’ data—data including the sensitive personal information, family histories, and health conditions of consumers,” AG Bonta said in a news release.

The lawsuit alleges violations of California’s Genetic Information Privacy Act (GIPA), Reasonable Data Security Law, False Advertising Law, Unfair Competition Law, and the California Consumer Privacy Act (CCPA).

AG Bonta seeks a court order requiring 23andMe to obey those laws in the future and requests monetary damages of $1,000 for each GIPA violation, $2,500 for each CCPA violation, $2,500 for each violation of the state’s business and professions code, with additional penalties where violations affected minors or senior citizens.

The California-based 23andMe emerged from Chapter 11 bankruptcy last year as a new nonprofit, the 23andMe Research Institute.

“The 23andMe Research Institute is a newly established independent nonprofit organization and is not involved in the matters described in the California Attorney General’s complaint filed against Chrome Holding Co., formerly known as 23andMe,” a spokesperson said. “The lawsuit pertains to events and operations associated with the former commercial entity prior to the creation of the 23andMe Research Institute. The institute was not involved in the complaint and has no role in the underlying litigation.”

IndustryNews: NewsStory GeneralNews CyberPrivacyFeed EHRNews DataPrivacy DataSecurity