California attorney general sues 23andMe for data breach

This is read by an automated voice.Please report any issues or inconsistencies here.

The California attorney general filed a lawsuit Thursday against the company formerly known as 23andMe, accusing the genetic testing service of failing to protect customers’ data during a 2023 breach.The data breach affected nearly 7 million people across the country, including more than 850,000 Californians, according to a release from Atty.

Gen.Rob Bonta’s office.

The exposed data contained sensitive material such as raw genetic information and health reports.Hackers listed the data for sale on the dark web in 2023, Bonta said.

23andMe filed for bankruptcy last year and was acquired by TTAM Research Institute, a nonprofit led by the company’s former Chief Executive Anne Wojcicki.Bonta filed suit against Chrome Holding Co., a subsidiary of TTAM and the corporate debtor name that 23andMe operated under during bankruptcy.

Business A bankruptcy judge approved the sale of 23andMe’s assets and business operations to a nonprofit led by 23andMe’s co-founder and former chief executive, Anne Wojcicki.“23andMe collected genetic data about millions of people, failed to meet its obligation under California law to keep that information safe, and then lied to consumers about the severity of its 2023 data breach,” Bonta said in a statement.A 2023 investigation by the California Department of Justice found that the hackers were able to operate within 23andMe’s systems for five months without being detected.

23andMe only began investigating once the data were offered for sale on the dark web, the investigation found.The hackers used a common tactic known as credential stuffing to access the data, which exploits weak and reused passwords.

“Businesses, particularly those that collect and maintain sensitive personal and genetic data, can and should know to guard against” credential stuffing, the attorney general’s release said.Business Twenty-seven states and the Dist...