For years, 23andMe offered a saliva kit that seemed almost playful while subtly promising clarity about ancestry, health, and hidden connections. Many customers mailed those kits with optimism that was remarkably similar to entrusting a friendly librarian with a family secret.
When the company revealed a data breach that affected millions of accounts in October 2023, that optimism was put to the test. Almost immediately, the tone changed from one of fascination to one of concern, especially as customers realized the information exposed was irreplaceable.
| Key | Value |
|---|---|
| Company | 23andMe, Inc., later renamed Chrome Holding Co. after bankruptcy-related asset changes |
| Core Legal Issue | Multiple class action lawsuits following a large-scale customer data breach disclosed in October 2023 |
| Data Involved | Genetic profiles, ancestry data, health-related information, and user account details |
| Legal Scope | U.S. and Canadian class actions, regulatory investigations, and bankruptcy court proceedings |
| Settlements | $30 million U.S. settlement; separate Canadian settlement subject to court approval |
| Reference | NPR |
Credit cards can be cancelled, passwords can be changed, and emails can be dropped, but genetic data does not behave that way. This immutability became the emotional and legal focal point of the lawsuits that quickly spread throughout several jurisdictions.
Attackers were able to obtain user profile information related to ancestry features by taking advantage of reused login credentials. This technical explanation seemed insignificant until one considered the extent of exposure and the extremely private nature of the data involved.
Inboxes were flooded with well-crafted notifications in the days after the revelation, but group chats and social media feeds presented a more relatable tale that combined uncomfortable humor with intense rage and a feeling that something personal had slipped out of reach.
Given that 23andMe promoted trust as a key component, class action lawsuits filed in the US and Canada claimed that the company had not implemented security procedures commensurate with the sensitivity of the data it collected. This claim seemed especially compelling.
The lawsuits focused on duty of care, a legal notion that felt very real all of a sudden. It suggested that businesses that handle genetic data should function more like institutions protecting priceless records than like consumer tech companies.
In September 2024, 23andMe reached a $30 million settlement in the US that included cash compensation and continued identity monitoring. While the package was remarkably comprehensive, it fell short in addressing the more general concerns about genetic exposure.
Although monitoring services are very good at spotting financial abuse, they don’t provide much comfort when the compromised material contains DNA, which can covertly survive across databases and new technologies without the owner’s continuous consent.
At about the same time, Canadian plaintiffs sought a different settlement, which reflected a court case influenced by regional privacy laws but motivated by remarkably similar worries about long-term harm and accountability.
Declining kit sales and research collaborations collided with the harm to 23andMe’s reputation brought on by the breach, making it more difficult to distinguish the company’s business issues from its legal ones as the cases progressed.
The lawsuits were completely reframed when the company filed for Chapter 11 bankruptcy protection in March 2025, dragging genetic privacy into the uncharted realm of asset valuation and insolvency procedures.
Since DNA shouldn’t be handled like office furniture during liquidation, dozens of state attorneys general moved to prohibit any sale of genetic data without express customer consent in response to that filing, which immediately alarmed regulators.
Regardless of how neatly it fits on a balance sheet, genetic data is fundamentally different from ordinary corporate assets because it has implications for families and future generations, according to their filings, which were remarkably clear in tone.
To assess the possible effects of any sale, a court-appointed consumer privacy ombudsman was brought in, underscoring how unprepared traditional legal frameworks are to deal with biotechnology on a large scale.
The frequent use of the word “irreversible” in those court documents caused me to pause longer than I had anticipated while reading them. I was struck by how infrequently the law encounters consequences that permanent.
Throughout the proceedings, 23andMe insisted that it would uphold its prior privacy pledges and adhere to relevant laws. Although these claims were legally accurate, many former customers viewed them with cautious skepticism.
Although they acknowledged that deleting their accounts would not completely undo what they had already shared, some users saw the breach as a turning point and decided to do so.
Though even seasoned tech users described genetic exposure as a category apart, carrying a weight that felt both personal and communal, others took a more practical stance, pointing out that breaches have become unsettlingly common.
Other genetics and health-data companies quietly reviewed consent language, retention policies, and encryption practices as a result of the lawsuits, which also prompted a wider industry recalibration. These adjustments could be especially helpful in rebuilding trust.
The main allegations made by the plaintiffs were significantly supported by regulatory investigations conducted in Canada and the UK, which found that 23andMe’s safeguards were insufficient and its response was too slow.
The situation was particularly instructive because of how quickly curiosity gave way to caution, serving as a reminder that innovation frequently outpaces governance, leaving users vulnerable in the interim.
However, the fallout has a forward-looking aspect as regulators, courts, and businesses all start to view genetic data as a unique class that needs more protection and defined ownership rights.
The 23andMe lawsuits point to a future in which consent is a continuous relationship that changes as technology advances and new applications arise rather than a one-time checkbox.
Customers learned the hard but obvious lesson that it’s important to ask not only what a service can reveal today, but also how that information might spread tomorrow.
What started out as a consumer science success story has evolved into a case study in accountability, which could eventually result in stronger regulations and noticeably better protections for anyone deciding to discover their genetic heritage.
