Wednesday, October 21st, 2026 — California Attorney General Rob Bonta has announced a $6 million settlement with Chrome Holding Co., formerly known as 23andMe, resolving allegations of inadequate data security and a legal dispute over the transfer of customers' genetic information during bankruptcy proceedings. The agreement, announced October 19, remains subject to approval by the U.S. Bankruptcy Court for the Eastern District of Missouri.
The litigation originated from a 2023 data breach that compromised information belonging to nearly 7 million 23andMe customers nationwide, including more than 855,000 California residents. State investigators alleged that the genetic testing company failed to maintain reasonable security protections for sensitive customer information and made misleading representations about its data practices.
The case grew more complicated after 23andMe filed for bankruptcy in March 2025. Certain company assets, including customers' genetic information and biological samples, were subsequently sold to TTAM Research Institute, a nonprofit established by 23andMe's co-founder and former CEO.
California's Department of Justice challenged the sale, arguing that transferring genetic information without customers' affirmative consent violated the state's Genetic Information Privacy Act. Both the bankruptcy court and district court rejected the state's objections, prompting an appeal that is now included in the proposed settlement.
The $6 million agreement would resolve California's pending claims concerning the data breach, alleged consumer misrepresentations and the disputed bankruptcy asset sale.
For insurance claims professionals handling cyber liability and privacy-related exposures, the proceedings illustrate how a data breach can develop into multiple legal disputes involving regulatory enforcement, corporate bankruptcy and the ownership of sensitive customer records. California's litigation extended beyond the original security incident to address how personal information could be transferred after the company's financial collapse.
Despite the bankruptcy and subsequent asset sale, affected California consumers retain the right to request deletion of their genetic information and destruction of stored biological samples. Customers may also withdraw previously granted permission for their genetic data to be used in research.
Bonta's office advised consumers to access their account settings to submit deletion requests, change sample-storage preferences or revoke research consent. Those rights remain available regardless of the company's change in ownership.
