California sues 23andMe over 2023 breach exposing 7M genetic profiles

California Attorney General Rob Bonta filed a lawsuit Thursday against genetic testing company 23andMe, alleging the firm's inadequate security practices allowed attackers to steal genetic data from nearly 7 million customers in a 2023 breach that went undetected for more than five months, ABC7 Los Angeles reported.

The case carries direct implications for Orange County's sizable Asian American community: prosecutors say roughly 1.1 million of the stolen records specifically targeted users of Asian-Pacific Islander and Ashkenazi Jewish descent during a period of rising hate incidents against both groups.

Attackers exploited a technique known as credential stuffing — feeding username and password pairs stolen in a separate 2017 MyHeritage data breach into 23andMe's login page — to compromise roughly 14,000 accounts, then harvested profile data belonging to nearly 7 million customers through those entry points, according to ABC7 Los Angeles.

The company missed multiple warning signs before taking action. Prosecutors said a suspicious spike in login activity in July 2023 and a Reddit post hinting at the breach in August were never properly investigated. 23andMe only launched an inquiry after the attacker posted stolen data on the dark web in October 2023 and then contacted the company to demand a ransom.

"23andMe's security measures were so lax that the threat actor was able to operate undetected within 23andMe's systems for over five months, and remarkably, 23andMe only began investigating after the threat actor offered the stolen user data for sale on the dark web and reached out to 23andMe to demand a ransom," prosecutors said in the complaint.

Among those affected, about 1.1 million records were drawn specifically from profiles of Asian-Pacific Islander and Ashkenazi Jewish users. Attorney General Bonta highlighted the timing. "The sale of this data on the dark web took place amidst a period of mounting anti-Asian American and Pacific Islander and antisemitic hate and violence," Bonta said in a press release. "This is disturbing and incredibly dangerous."

Stolen files included raw genetic profiles, health predisposition reports, DNA relationship matches shared with relatives and basic personal identifiers such as birth year and location. The lawsuit also alleges the company made misleading statements that downplayed the breach's scope in its public communications afterward.

23andMe filed for bankruptcy in March 2026 and has since rebranded as Chrome Holding Co. The attorney general's suit, filed against the company under its new name, seeks civil penalties and court injunctions barring further violations of California privacy law.