California Sues 23andMe's Bankruptcy Successor Over 2023 Data Breach
AG Rob Bonta is going after Chrome Holding Co. — the shell 23andMe rebranded into after its bankruptcy — arguing the company failed to adequately protect the genetic and personal data of millions of users.
California Attorney General Rob Bonta filed suit against Chrome Holding Co., the entity 23andMe rebranded under after filing for bankruptcy last March. The target is the same company, different nameplate. The claim is straightforward: 23andMe didn't do enough to protect user data before the 2023 breach, and people's genetic information paid the price.
The failure mode here is one we've seen before in breach litigation — a company collects extraordinarily sensitive data, runs lean on security controls, gets hit, files for bankruptcy, and then tries to exit cleanly through a rebranding. California is saying that exit isn't clean.
Genetic data is not a leaked password. You can rotate credentials. You cannot rotate your ancestry. When a data set includes health predispositions, ethnicity estimates, and family relationships, the downstream harm isn't theoretical — it's permanent. That's the specific weight California is putting behind this lawsuit, and it's the right framing.
The 2023 breach itself was a credential-stuffing attack. Attackers used previously leaked username-and-password pairs to authenticate against 23andMe accounts directly. In practice, this is a preventable failure vector. Mandatory MFA, rate limiting on authentication endpoints, anomaly detection on bulk profile scraping — these are table-stakes controls for any platform sitting on data this sensitive. The post-mortem will say the attack was sophisticated. It wasn't. It was opportunistic.
The bankruptcy-to-rebrand maneuver matters legally. Bonta's office is filing against Chrome Holding Co. specifically because that's where the liability has to follow. Whether California courts agree that successor liability attaches cleanly is the actual legal question this suit turns on.
For platform and security teams watching this: if your organization holds a category of data that is irreplaceable or immutable — biometrics, genetic sequences, medical records — your authentication and access controls need to reflect that asymmetry. The data doesn't get less sensitive because your company is burning cash.
Operational takeaway: credential stuffing is a solved problem if you enforce MFA; choosing not to is a policy decision, not a technical limitation.
