California Sues 23andMe Over Massive 2023 Data Breach
Tap title to read story
San Francisco — California Attorney General Rob Bonta sued Chrome Holding Co., the company formerly known as 23andMe, in San Francisco Superior Court on Thursday, May 28, alleging the firm failed to protect customers' genetic, ancestry and health-related data after a breach that began in April 2023 and reportedly lasted several months.
The complaint states hackers used credential-stuffing to access about 14,000 accounts initially disclosed in October 2023 and then scraped profiles linked to nearly 6.9 million users, including roughly 855,000 Californians; Bonta seeks civil penalties, injunctions and oversight while litigation proceeds this year and regulators and privacy groups review potential wider policy responses.
More context
Timeline
- 1. April 2023: Breach begins and persists for approximately five months.
- 2. October 2023: Company publicly discloses around 14,000 accounts accessed.
- 3. Subsequent analysis reveals scraping of nearly 6.9 million linked profiles.
- 4. Prior March: Company filed for bankruptcy and is legally known as Chrome Holding Co.
- 5. May 28, 2024: California AG Rob Bonta files suit in San Francisco Superior Court.
Why it matters
This data breach could affect your privacy. If you've used 23andMe, your genetic and health data might be exposed. It's a good idea to monitor your accounts and watch for any suspicious activity.
Sources
JQJO Editorial Desk · Human reviewed · AI assisted. Report a correction.











