# California Secures $6 Million Settlement From Former 23andMe Over Data Breach

> Attorney General Rob Bonta announced the agreement with Chrome Holding Co., resolving claims from a 2023 breach that exposed genetic data of 6.9 million customers.

By PrimaryBrief newsroom · Published 2026-10-19T21:52:28.053526Z
Canonical: https://primarybrief.com/article/california-secures-6-million-settlement-from-former-23andme-over-data-breach-3e70eca3

California secured a $6 million settlement from Chrome Holding Co., formerly 23andMe, on October 19, 2026, resolving claims from a 2023 data breach that exposed the genetic and personal information of approximately 6.9 million customers globally, including over 855,000 Californians [1][5][7][11][17][19][20][21].

This settlement shows the ongoing legal consequences for companies failing to protect sensitive genetic data, reinforcing the importance of corporate responsibility in a sector dealing with highly personal information [1][6]. Consumers are reminded of their right to control their genetic data, including requesting deletion and destruction of samples [6].

## What the Records Show
The $6 million settlement, announced by Attorney General Rob Bonta, addresses allegations that 23andMe failed to adequately secure customer data [1][6][11]. The 2023 breach, caused by a "credential stuffing" attack, allowed unauthorized access to genetic and personal details, such as ancestry information, health data, display names, and predicted relationships [18][19][20]. California pursued this separate settlement after declining an $18 million multi-state agreement involving 41 states and the District of Columbia [2][12][14]. The state had also filed its own lawsuit in June 2026, alleging violations of the Genetic Information Privacy Act and inadequate data security practices [2].

23andMe filed for Chapter 11 bankruptcy in March 2025, citing the breach and related litigation [2][15]. Its assets were later sold for $305 million to TTAM Research Institute, a nonprofit controlled by 23andMe co-founder Anne Wojcicki [1][2][15]. California had tried to block this sale, arguing it violated state law by selling customer data without explicit consent [1][2][6][15]. A U.S. bankruptcy judge had previously approved a separate $46.75 million settlement for data breach victims on July 8, 2026 [3][4][8][13][16].

## What the Attorney General Said
Attorney General Rob Bonta emphasized the state's stance on data protection, stating, "23andMe collected genetic data about millions of people and failed to meet its obligation to keep that information safe. Companies cannot evade California's consumer protection and privacy laws by filing for bankruptcy" [6][11]. He also affirmed that Californians have the right to control their genetic data, encouraging customers to request the deletion of their information and destruction of their samples [6].

## What we could not confirm
The specific details regarding how the $6 million from California's settlement will be used or distributed within the state could not be confirmed from the available records. It also remains unclear if there are further legal actions California might pursue regarding the bankruptcy court's July 10, 2026, ruling that prohibited the state from seeking monetary relief against the company's successor [2].

## Evidence cited
1. California to recieve $6m settlement after 23andMe data breach (www.theguardian.com) — https://www.theguardian.com/us-news/2026/oct/19/california-settlement-23andme-data-breach
2. AG Bonta's office sues 23andMe in state court (San Francisco Business Times) — https://bizjournals.com/sanfrancisco/news/2026/06/25/23andme-ag-bonta-data-breach-lawsuit-bankruptcy.html
3. Genetic testing company 23andMe ordered to pay nearly $50 million for data leak (FOX 5 DC) — https://www.fox5dc.com/news/genetic-testing-company-23andme-ordered-to-pay-nearly-50-million-for-data-leak
4. 23andMe Ordered to Pay $46.75 Million in Data Breach Settlement (Beinsure) — https://beinsure.com/23andme-ordered-pay-46-75-mln-data-breach-settlement/
5. 23andMe Lawsuit Update: Navigating the Complexities of Data Breach Claims (The Silicon Review) — https://www.thesiliconreview.com/news/news-item/23andme-lawsuit-update-navigating-the-complexities-of-data-breach-claims/
6. Attorney General Bonta Secures $6 Million Settlement in 23andMe Litigation (California Attorney General) — https://ca.gov/news/release/2026-10-19-attorney-general-bonta-secures-6-million-settlement-in-23andme-litigation
7. 23andMe Data Breach Litigation (Keller Rohrback LLP) — https://www.kellerrohrback.com/cases/23andme-data-breach-litigation
8. Genetic testing company 23andMe ordered to pay nearly $50 million for data leak (FOX 5 NY) — https://www.fox5ny.com/news/genetic-testing-company-23andme-ordered-to-pay-nearly-50-million-for-data-leak
9. 23andMe Data Breach Settlement Payment Date and Updates (Settlement Insight) — https://settlementinsight.com/23andme-data-breach-settlement-payment-date-and-updates/
10. 23andMe Data Breach Settlement (Try Payout) — https://trypayout.app/settlements/23andme-data-breach
11. California Secures $6M Settlement From 23andMe After 2023 Data Breach (Traders Union) — https://www.tradersunion.com/news/forex-news/finance/california-secures-6m-settlement-from-23andme-after-2023-data-breach-139366/
12. 23andMe Agrees to $18 Million Multistate Settlement Over Data Breach (Law Commentary) — https://lawcommentary.com/23andme-agrees-to-18-million-multistate-settlement-over-data-breach/
13. US Bankruptcy Judge Approves $46.75 Million 23andMe Data Breach Settlement (Claims Journal) — https://www.claimsjournal.com/news/national/2026/07/08/333333.htm
14. 23andMe Agrees to $18M Multi-State Settlement (HIPAA Journal) — https://www.hipaajournal.com/23andme-agrees-to-18m-multi-state-settlement/
15. 23andMe data breach: Lawsuits, bankruptcy, what to know (CBS News) — https://www.cbsnews.com/news/23andme-data-breach-lawsuits-bankruptcy-what-to-know/
16. 23andMe Data Breach Settlement Gets Preliminary Approval (HIPAA Journal) — https://www.hipaajournal.com/23andme-data-breach-settlement-gets-preliminary-approval/
17. 23andMe Confirms 6.9 Million Users Impacted By Data Breach (HIPAA Journal) — https://www.hipaajournal.com/23andme-confirms-6-9-million-users-impacted-by-data-breach/
18. 23andMe data leak (Wikipedia) — https://en.wikipedia.org/wiki/23andMe_data_leak
19. 23andMe Data Breach: What Happened & What to Do (Security.org) — https://www.security.org/news/23andme-data-breach/
20. 23andMe Data Breach Update: Timeline, Impact, & What to Do (Enzoic) — https://www.enzoic.com/blog/23andme-data-breach/
21. Investigation into 23andMe data breach (2025) (Office of the Privacy Commissioner of Canada) — https://priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2025/pipeda-23andme-2025/