GRC

23andMe successor to pay California $6m: liability outlives firm

Chrome Holding, formerly 23andMe, agrees to pay California $6m over its 2023 breach. Why UK boards should note liability surviving bankruptcy.

Scales of justice graphic with the headline Breach liability outlives 23andMe bankruptcy

California has agreed a $6 million settlement with the shell company left behind by 23andMe, three years after a credential stuffing campaign exposed genetic and family data on almost 7 million people. Bankruptcy, a sale of the customer database and a change of name did not stop the regulators, and UK boards should take that lesson seriously.

What happened

On Monday 19 October 2026, California Attorney General Rob Bonta announced a $6 million settlement with Chrome Holding Co., the entity that still carries 23andMe’s debts and liabilities. The agreement was filed the same day in the US Bankruptcy Court for the Eastern District of Missouri and still needs the court’s approval.

It closes two separate fights. The first is a state court lawsuit, filed in May 2026, which alleged that the company’s weak data security contributed to the 2023 breach and that it misled customers and the public about how well their data was protected. The second is California’s appeal over the bankruptcy sale itself. The state had argued that transferring genetic information and saliva samples to a new owner without customers’ explicit consent breached its Genetic Information Privacy Act. Both the bankruptcy court and the federal district court rejected that objection, and the state is abandoning any further appeal under the terms of the settlement.

Under the settlement, affected customers keep the right to have their data deleted and their biological samples destroyed. Bonta’s message was blunt: in his words, companies “cannot evade California’s consumer protection and privacy laws by filing for bankruptcy”.

The detail

The underlying incident is well documented. Between April and September 2023 an attacker ran a credential stuffing campaign against 23andMe, logging in with passwords reused from earlier, unrelated breaches. Around 14,000 accounts were taken over directly, but the DNA Relatives feature allowed the attacker to reach profile information linked to roughly 6.9 million users. More than 855,000 of those were Californians. The company confirmed the breach in October 2023, after stolen data was advertised for sale online.

The corporate story that followed matters as much as the technical one. 23andMe filed for Chapter 11 protection in March 2025. In July 2025 the bankruptcy court approved the sale of its operating assets, including the genetic database and samples, to TTAM Research Institute, a non-profit set up by co-founder and former chief executive Anne Wojcicki, for $305 million according to Reuters. TTAM says it had no involvement in the settlement. The liabilities stayed with the renamed shell, Chrome Holding.

The California payment is the latest in a long line. The bankruptcy court had already approved a $46.75 million fund for breach victims, and in July Chrome Holding agreed to pay $18 million to more than 40 other US state attorneys general. In the UK, the Information Commissioner’s Office fined 23andMe £2.31 million in June 2025, following a joint investigation with the Office of the Privacy Commissioner of Canada. That case covered 155,592 UK residents.

The ICO’s findings read like a checklist of missing basics. Multi-factor authentication was not mandatory, there were no extra verification steps before raw genetic data could be downloaded, and monitoring failed to pick up months of suspicious login activity. The regulator also criticised the response: a claim of mass data theft in August 2023 was dismissed as a hoax, and a full investigation did not start until October. Information Commissioner John Edwards described it as a “profoundly damaging breach”.

Timeline of the 23andMe breach from the 2023 credential stuffing attack to California's $6 million settlement in October 2026

Why it matters for UK organisations

The headline figure is small next to 23andMe’s other bills, but the governance point is large. Regulatory and legal liability for a breach outlived the business that caused it, survived a court-approved sale of the data, and was pursued against a holding company with a new name and no operating business. Data, meanwhile, moved to a new owner under a different structure. Genetic information cannot be reset like a password, so the risk to the people concerned never expires.

For UK organisations this sits squarely within existing law. Under UK GDPR, a controller’s accountability does not lapse because it is in financial distress, and administrators and buyers inherit difficult questions about lawful basis, transparency and security when personal data is sold as an asset. Any buyer of a distressed company should assume that the regulators will treat the database as a liability as well as an asset.

There is also a cross-border lesson. The ICO worked with its Canadian counterpart, while US states acted both individually and as a coalition. A UK firm with customers in several jurisdictions should expect parallel enforcement for the same incident, each regulator applying its own rules and its own timetable.

Expert view

What strikes me most is how ordinary the root cause was. Credential stuffing is not sophisticated. When we test customer-facing portals, the controls that stop it are among the first things we look at: enforced multi-factor authentication, rate limiting, detection of logins from known breached credentials, and step-up checks before anything sensitive can be exported. None of that is exotic, and all of it would have narrowed this incident considerably.

The second failure was design. A sharing feature meant a small number of compromised accounts exposed data on millions of other people who had done nothing wrong. Threat modelling should ask, for every feature that links users together, what one stolen login can reach. In my experience that question is rarely asked of social or matching features until after something goes wrong.

The governance angle is the one boards most often miss. Deal teams treat customer data as something to value and transfer. They spend far less time on the breach history, open regulatory investigations and consent records that come attached to it. This case shows those liabilities following the corporate shell for years.

What to do now

  1. Enforce MFA on every customer and staff account that touches sensitive data. This is a core Cyber Essentials requirement for cloud services, and the ICO named its absence directly.
  2. Add step-up verification before bulk export or download of special category data such as health or genetic information.
  3. Detect credential stuffing. Monitor for login failures across many accounts, screen passwords against known breach corpora, and rate limit authentication endpoints.
  4. Threat model data-sharing features so a single compromised account cannot expose other users’ information at scale.
  5. Treat third-party claims of data theft as incidents until disproved, with a defined route into your incident response plan.
  6. Build data protection into insolvency and M&A planning. Map consent, retention and open regulatory matters before any sale, and give customers a clear deletion route.
  7. Brief the board that breach liability can outlast the company, a sale or a rebrand, and record that discussion in the risk register.

Bottom line

23andMe went bankrupt, sold its data and changed its name, and regulators on both sides of the Atlantic still pursued it. The lesson for UK boards is simple: weak authentication creates a liability that does not disappear with the business, so fix the basics now rather than leave the bill to whoever inherits the data.

Sources

Related Posts