California Attorney General sues 23andMe successor for 2023 data breach

California Attorney General Rob Bonta will sue DNA testing firm Chrome Holding, alleging its predecessor 23andMe failed to protect the sensitive genetic data of nearly seven million users in a 2023 breach [1]. The lawsuit follows a state investigation which found the company "failed to take basic steps to protect users' data" and "lied to consumers about the severity of its 2023 data breach" [1]. The exposed information included genetic predispositions, risk factors, ancestry, and details of biological relatives [1]. Bonta called the breach "disturbing and incredibly dangerous," noting that data sold on the dark web was specifically marketed as belonging to Asian American Pacific Islander and Jewish users during a period of rising hate crimes [1]. The 2023 incident was a credential-stuffing attack, where hackers used passwords from prior breaches to access accounts [1]. This breach has triggered international regulatory action. Last year, the UK's Information Commissioner's Office (ICO) fined 23andMe £2.31m for failing to secure sensitive user data prior to the incident, which accessed the personal data of 155,592 UK residents [1]. The ICO found the company violated UK law by not implementing appropriate authentication measures [1]. The company, which was co-founded by Anne Wojcicki, has since filed for bankruptcy and rebranded as Chrome Holding [1]. Anne Wojcicki is the sister of the late Susan Wojcicki, the former CEO of YouTube [3]. Susan Wojcicki was a key early Google employee, having rented her garage to the company's founders and later advocating for Google's $1.65 billion acquisition of YouTube in 2006 [3]. 23andMe has stated it has "made several binding commitments to enhance protections for customer data and privacy" [1].