23andMe Reaches $6 Million Settlement Over Data Breach Affecting Nearly 7 Million Customers

October 21, 2026

23andMe data breach settlement — California has reached a $6 million settlement with the company formerly known as 23andMe following a 2023 data breach affecting nearly 7 million customers. Consumers retain important rights concerning the deletion of genetic data and stored biological samples. Jennie Book/Shutterstock

California Attorney General Rob Bonta has announced a $6 million settlement with the company formerly known as 23andMe, resolving allegations involving a massive data breach and the handling of customers’ sensitive genetic information.

The agreement follows a 2023 cybersecurity incident that affected nearly 7 million customers nationwide, including more than 855,000 California residents.

According to the California Department of Justice’s October 19 announcement, the settlement was reached with Chrome Holding Co., formerly known as 23andMe, and filed in federal bankruptcy court in Missouri.

The agreement remains subject to court approval.

For current and former customers, the development raises an important question: What happens to your genetic information after a company experiences a data breach or changes ownership?

California Alleges 23andMe Failed to Protect Sensitive Customer Data

23andMe became one of the country’s largest direct-to-consumer genetic testing companies by offering DNA analysis through saliva samples.

Customers used its services to learn about ancestry, family connections, and potential genetic health predispositions.

However, a 2023 data breach exposed sensitive personal and genetic information belonging to millions of customers.

California investigators alleged that the company failed to maintain reasonable security measures and made misleading statements about its data protection practices and the breach.

The state’s investigation found that attackers gained access to customer accounts and exploited vulnerabilities that allowed them to obtain information associated with millions of users.

Bankruptcy Raised Additional Questions About Genetic Privacy

The controversy continued after 23andMe filed for bankruptcy in March 2025.

As part of the bankruptcy proceedings, certain company assets, including customer genetic data and biological samples, were sold to TTAM Research Institute, a nonprofit established by 23andMe co-founder and former CEO Anne Wojcicki.

California’s Department of Justice challenged the transaction, arguing that transferring genetic information without customers’ separate and explicit consent conflicted with the state’s Genetic Information Privacy Act.

Both the Bankruptcy Court and District Court rejected the state’s objection, prompting an appeal.

The newly announced settlement resolves that appeal along with California’s separate legal claims concerning the 2023 data breach.

What Does the $6 Million Settlement Mean for Customers?

The settlement provides for a $6 million payment to resolve California’s pending claims against the company.

However, the announcement does not establish that every affected 23andMe customer will automatically receive a payment.

The agreement is separate from an earlier nationwide consumer data breach settlement, under which the court approved $46.75 million and payments to approved claimants were issued in September 2026.

Customers should avoid assuming that the new California agreement creates another automatic payout or requires them to submit financial information through an unsolicited message.

Anyone seeking information about potential compensation should rely on official settlement administrators or government announcements rather than unfamiliar websites or emails.

California Customers Can Still Request Deletion of Their Genetic Data

One of the most important takeaways involves consumers’ ability to control their genetic information.

California Attorney General Rob Bonta emphasized that eligible customers retain the right to request deletion of their personal genetic data and destruction of stored biological samples, regardless of the company’s ownership.

According to the Attorney General’s Office, customers can begin the deletion process by signing into their 23andMe account and opening the Settings section.

From there, they can locate the 23andMe Data section, select the option to view their information, and follow the steps to permanently delete their data.

Customers who want to retain a personal copy of their genetic information should consider downloading it before completing a deletion request.

How to Request Destruction of Stored DNA Samples

Deleting account information isn’t the only privacy option available to customers.

Individuals who previously authorized 23andMe to store their saliva samples or DNA may request destruction of those biological materials.

The California Attorney General’s Office directs customers to review their account settings under Preferences to change their sample-storage selections.

Customers who previously agreed to research use of their genetic information can also withdraw that consent through the Research and Product Consents section.

These requests address different types of stored information, so customers should review each option rather than assuming that changing one setting automatically handles every privacy concern.

Protecting Your Information After a Data Breach

The 23andMe case highlights why consumers should pay attention to how companies collect, store, and transfer sensitive personal information.

Genetic data is particularly sensitive because it can reveal information about family relationships, ancestry, and potential health risks.

Customers concerned about account security should review their passwords, avoid reusing login credentials across websites, and enable multifactor authentication where available.

They should also remain alert for phishing messages that reference the 23andMe breach or promise settlement payments in exchange for personal or financial information.

Consumers can review the California Attorney General’s official announcement for information about their privacy rights and available deletion procedures.

What Former 23andMe Customers Should Do Next

The $6 million settlement marks another development in the legal fallout from 23andMe’s 2023 data breach and subsequent bankruptcy.

Although the agreement is awaiting court approval, California officials have emphasized that customers retain important rights concerning their genetic information.

Anyone who previously submitted a DNA sample should consider reviewing their account settings, stored data preferences, and research consent selections.

Customers should also distinguish the new California settlement from earlier consumer compensation programs to avoid confusion about potential payments.

For people who trusted a genetic testing company with deeply personal information, understanding what data remains stored and how to exercise available privacy rights is an important step toward protecting themselves.