California Sues 23andMe's Bankruptcy Successor Over 2023 Data Breach
AG Rob Bonta is going after Chrome Holding Co., the shell 23andMe rebranded into after its bankruptcy, arguing the company failed to adequately protect the genetic and personal data of millions of users.
Key points
- California AG Rob Bonta filed suit against Chrome Holding Co., the entity 23andMe rebranded under after filing for bankruptcy last March.
- The 2023 breach was a credential-stuffing attack using previously leaked username-and-password pairs.
- Genetic data cannot be changed after exposure, making the downstream harm permanent rather than correctable.
- California is arguing that the bankruptcy-to-rebrand maneuver does not extinguish predecessor liability.
- Mandatory MFA and authentication rate-limiting are standard controls for platforms holding irreplaceable data.
What actually happened here
California AG Rob Bonta filed suit against Chrome Holding Co., the name 23andMe rebranded under after filing for bankruptcy last March. Same company, new nameplate. The claim is that 23andMe ran lean on security controls before the 2023 breach, and users' genetic information paid for it.
The breach was credential stuffing: attackers used previously leaked username-and-password pairs to authenticate against 23andMe accounts directly. That's a preventable failure vector. Mandatory MFA, rate limiting on authentication endpoints, anomaly detection on bulk profile scraping, these are baseline controls for any platform sitting on data this sensitive. The post-mortem language will reach for "sophisticated." It was opportunistic.
Genetic data is not a leaked password. Credentials you can rotate. Your ancestry you cannot. When a dataset includes health predispositions and family relationships, the harm isn't speculative, it's permanent. That's the specific weight California is putting behind this lawsuit, and it's the right framing.
Should you worry about the rebrand defence
The bankruptcy-to-rebrand maneuver is the live legal question. Bonta's office is filing against Chrome Holding Co. Specifically because that's where the liability has to follow. Whether California courts agree that successor liability attaches is what this suit actually turns on, and the answer will matter to any company that thinks a Chapter 11 filing clears the compliance ledger.
For security teams watching this: if your organisation holds a category of data that is irreplaceable or immutable, biometrics, genetic sequences, medical records, your authentication and access controls need to reflect that asymmetry. The data doesn't get less sensitive because the company is burning cash.
Our earlier look at how S&P 200 CISOs are framing cybersecurity risk to the SEC found a suspicious abundance of "no material impact" disclosures across 2024 and 2025 filings. California's theory here is that impact on genetic data is always material, and courts may yet agree.
Credential stuffing is a solved problem if you enforce MFA. Choosing not to enforce it is a policy decision, not a technical limitation. When that decision produces a breach, expect the attorney general's office to treat it that way.
