2026 California AG lawsuit — 2023 breach affecting ~7M; raw genetic data (May 30 filing)
Data compromised
Raw genetic information, health reports, ancestry-related data, names, and account identifiers per AG complaint summaries
Technical writeup
California Attorney General Rob Bonta filed suit May 30, 2026 against Chrome Holding Co. (the corporate debtor name for the genetic-testing business formerly marketed as 23andMe) alleging failure to protect customer data during the October 2023 credential-stuffing and DNA Relatives scraping incident. The AG’s office said the breach affected nearly 7 million people nationwide, including more than 850,000 Californians, with exposed material including raw genetic information and health reports later listed for sale on criminal markets. The suit follows 23andMe’s bankruptcy and acquisition by TTAM Research Institute (nonprofit led by former CEO Anne Wojcicki). BreachHistory links this 2026 enforcement action to the underlying 2023 intrusion documented separately as breach id 23me2023.
Root cause
2023 credential stuffing and abuse of DNA Relatives feature; alleged inadequate safeguards per California AG
References
- https://www.latimes.com/business/story/2026-05-30/california-attorney-general-sues-23andme-for-data-breach
- https://oag.ca.gov/news/press-releases/attorney-general-bonta-sues-chrome-holding-co-formerly-known-23andme-over-2023
- https://www.reuters.com/world/us/23andme-notifies-customers-data-breach-into-its-dna-relatives-feature-2023-10-24/