California Attorney General Rob Bonta announced an approximately $6 million settlement with Chrome Holding Co., formerly 23andMe, on October 19, 2026.

 

What happened

The agreement addresses the company’s 2023 data breach and California’s challenge to the transfer of customers’ genetic information during bankruptcy. It was filed in the U.S. Bankruptcy Court for the Eastern District of Missouri and was awaiting court approval when announced.

The breach affected nearly 7 million customers, including more than 855,000 Californians. Canadian and UK regulators found that an attacker used login credentials stolen from other websites to access approximately 18,000 accounts. Features that shared information between genetic relatives expanded the exposure to millions of additional customers.

California alleged that 23andMe failed to maintain reasonable security safeguards and misled consumers about its data protection practices. The state’s complaint also alleged that the attacker operated undetected for more than five months.

After filing for bankruptcy in March 2025, 23andMe sold assets, including customer genetic information and biological samples, to TTAM Research Institute, a nonprofit established by cofounder Anne Wojcicki. California argued that the transfer required customers’ separate, explicit consent under its Genetic Information Privacy Act. The bankruptcy and district courts rejected California’s objection.

The settlement provides for a $6.01 million payment and dismissal of the state’s claims and related appeals, without an admission of liability. The filed agreement requires payment to California within 10 calendar days after the court’s approval. Customers retain the right to request deletion of their information, destruction of stored samples, and withdrawal of research consent.

 

What was said

The agreement leaves that decision to California’s Attorney General. It states that funds “may be used in the sole discretion of the Attorney General” for consumer relief and associated costs. Any money not used for that purpose must be transferred within one year to the Unfair Competition Law Fund for consumer protection enforcement. The agreement does not establish a fixed payment for each affected customer.

 

Why it matters

Genetic information can create privacy risks for relatives as well as the person tested. A 2018 study published in Science and available through NCBI analyzed 1.28 million consumer genetic profiles to examine identification through distant relatives. The authors reported that “the technique can also identify research participants of a public sequencing project.” The findings show why removing names from genetic records does not eliminate every risk of identification.

For healthcare organizations, the practical concern extends to genetic results shared through email. Paubox’s 2026 Healthcare Email Security Report identified 170 email-related healthcare breaches reported to HHS in 2025. The report covers healthcare email incidents in 2025 and provides broader context for protecting genetic results in patient communications. For clinics sending genetic reports, a practical response is to review HIPAA compliant email protections, recipient verification, and staff access to sensitive results.

See also: HIPAA Compliant Email: The Definitive Guide (2026 Update)

 

FAQs

Was this a HIPAA enforcement action?

No, California’s complaint alleged violations of state privacy and consumer protection laws, including the Genetic Information Privacy Act and the California Consumer Privacy Act. The settlement concerns California’s claims and bankruptcy-related disputes.

 

Is this the same as the consumer class-action settlement?

No. A separate settlement addresses claims brought on behalf of affected U.S. consumers. According to the court-authorized settlement website, the court approved a final amount of $46.75 million on July 7, 2026, and payments for approved claims were issued on September 29 and 30.

 

Does deleting an account remove information already used in research?

Not necessarily. 23andMe’s privacy statement says research performed or published before withdrawal of consent will not be reversed. Account deletion is also subject to retention requirements, so certain information may remain where applicable obligations require it.