California Sues 23andMe Over Security Failures and 2023 Data Breach
Summary
California’s attorney general sued 23andMe over alleged security failures and misleading statements related to a 2023 credential-stuffing breach that exposed sensitive data from about 6.9 million customers.
Key points
- California Attorney General Rob Bonta filed suit against 23andMe, now Chrome Holding Co., over the 2023 breach.
- The breach exposed data from about 6.9 million customers, including genetic, health, ancestry and DNA-relative information.
- 23andMe said the exposed data was genuine and attributed its extraction to credential-stuffing attacks; attackers targeted DNA Relatives accounts.
- The complaint alleges that the company lacked reasonable safeguards, missed signs of intrusion and failed to catch a coding error.
- The Attorney General also alleges that 23andMe made misleading statements about its security and the severity of the breach.
- The lawsuit alleges violations of several California privacy and consumer-protection laws and seeks an injunction and statutory penalties.
Article Details
- Event Type
- California Attorney General lawsuit over the 2023 23andMe data breach and alleged failures to protect customer data.
- Impact
- The breach exposed data from approximately 6.9 million customers, including 855,541 Californians. Exposed information included genetic and health-predisposition data, ancestry and ethnicity information, biological relatives, and DNA matches. The complaint alleges inadequate safeguards, missed intrusion indicators, an undetected coding error in DNA Relatives, and misleading public statements. It seeks an injunction and statutory penalties of $1,000–$7,500 per violation.