While 42 states settled with 23andMe this month over the 2023 breach that exposed 6.9 million customers' genetic data, California, home of the Bay Area company, is not among them. The state is pursuing its own lawsuit instead.
Attorney General Rob Bonta sued Chrome Holding Co., the company that took control of 23andMe after its 2025 bankruptcy, in San Francisco Superior Court in May. The complaint accuses the company of failing to protect user data, ignoring known system vulnerabilities and downplaying the severity of the breach, and it seeks civil penalties, according to news reports and the filed complaint. The case is pending.
The multistate settlement California sat out, announced July 14, allowed the participating states' claims at $150 million and pays out $18 million immediately from the bankruptcy estate, alongside new data-security requirements for the company's custodian, including risk assessments, an independent advisory board and preserved data-deletion rights.
The breach itself began with credential stuffing: attackers reused passwords stolen elsewhere to access thousands of 23andMe accounts, then harvested data on millions more users through the service's sharing features. The company disclosed the intrusion in October 2023; exposed data included names, ancestry details and genetic markers, some later offered for sale online.
California consumers are not left out of compensation entirely. A separate $46.75 million class-action settlement, approved by a bankruptcy judge July 6, covers affected consumers nationwide who filed claims by February 17, 2026. What the state itself recovers will depend on the outcome of Bonta's suit.
