UsefulCharts Called DNA Testing “Pretty Safe.” Then 23andMe Exposed 6.9 Million Customers.
Matt Baker tested 10 DNA services, compared their prices, examined their ancestry predictions, and gave viewers a practical guide to choosing between them. His UsefulCharts video was careful about the limits of genetic science. It was considerably less careful about the limits of corporate promises.
After reviewing privacy policies, Baker offered a reassuring conclusion: consumer DNA testing was generally safe. Companies would protect personal information, research data would be anonymized, police access would be restricted, and customers could delete their information.
Then came 23andMe.
In 2023, attackers compromised genetic and personal information associated with approximately 6.9 million customers. In 2025, 23andMe entered bankruptcy and sold its business, including customer genetic data and biological samples, for $305 million. In October 2026, California announced a $6 million settlement of allegations concerning the breach and challenged transfer of genetic information, pending bankruptcy court approval.
The distinction matters: Baker published his review in 2022, before these events occurred. He could not have known that 23andMe would suffer this particular attack or bankruptcy.
But he could have recognized the weakness in his reassurance.
A privacy policy describes what a company promises to do. It cannot establish that the company is capable of keeping that promise, that attackers will respect it, or that future owners will inherit precisely the obligations customers believed they were accepting.
Baker made a useful comparison of genetic testing products. When he turned to privacy, he treated corporate assurances as though they were evidence of security.
The difference has become painfully expensive.
1. The Breach Was Not Just a Password Problem. It Was a Family-Tree Problem.
The most revealing fact about the 23andMe breach is not simply that millions of customer profiles were exposed.
It is how relatively few compromised accounts allowed the attackers to reach so many people.
According to California's investigation, attackers initially gained access to approximately 14,000 accounts through credential stuffing. This involves trying usernames and passwords already exposed in other breaches.
The attackers then exploited weaknesses in 23andMe's DNA Relatives feature, which connected customers to people identified as their biological relatives.
That access expanded the breach to approximately 6.9 million customer profiles. The information exposed varied: directly compromised accounts could contain genetic and health reports, while millions of additional profiles exposed ancestry and family-relationship information rather than complete genetic records.
Consider the arithmetic.
Approximately 14,000 compromised accounts became the entry point for a breach affecting 6.9 million profiles.
That is nearly 500 affected profiles for every account initially compromised.
The ratio is an illustration of the breach's scale, not a claim that every compromised account exposed exactly 500 people. But it captures what Baker's privacy discussion failed to confront.
A consumer genealogy database is not merely a collection of separate customer records.
It is a network of biological relationships.
Access to one person's genetic connections can expose information about other people who never lost control of their own passwords.
And this was not an entirely unforeseeable weakness.
California's May 2026 complaint alleged that 23andMe failed to address known credential-stuffing risks, overlooked suspicious activity, and allowed attackers to exploit a coding error in its relative-matching system.
The state further alleged that attackers operated for approximately five months before the breach was discovered. These are findings and allegations presented by the Attorney General, not a final judicial determination of every disputed claim.
In July 2026, a coalition of state attorneys general announced a settlement of bankruptcy claims arising from the same breach. Michigan's Attorney General identified deficient authentication safeguards, monitoring, intrusion detection, and vulnerability management among the problems uncovered during the multistate investigation.
The failure was not that a sophisticated criminal somehow discovered the existence of DNA.
It was that an organization holding extraordinarily sensitive information allegedly failed to implement ordinary protections against established cyberattacks.
Baker evaluated privacy principally by reading what companies said they would do.
The 23andMe breach demonstrated the danger of judging security by promises rather than by the systems responsible for keeping them.
2. The DNA Customers Submitted Became an Asset in Bankruptcy
The next failure was not technological.
It was financial.
In March 2025, 23andMe filed for bankruptcy protection. The company subsequently entered a court-supervised sale process.
The successful bidder was TTAM Research Institute, a California nonprofit founded and led by 23andMe co-founder Anne Wojcicki.
The final purchase price was $305 million.
The transaction included the company's consumer genetic testing and research operations. Customer genetic information and biological samples were among the assets transferred. The acquisition was completed on July 14, 2025.
This was not a secret sale to an unidentified data broker. The purchaser was associated with the company's founder and committed to additional privacy protections.
Those distinctions are important.
TTAM agreed to maintain customer deletion rights, preserve research opt-out options, establish privacy oversight, and restrict certain future transfers of genetic information.
Customers were also to receive notice of the transaction and instructions for exercising their privacy choices.
These protections were meaningful, but they did not settle the fundamental argument over consent.
California's Attorney General objected to the sale.
The state argued that California's Genetic Information Privacy Act required separate, explicit customer consent before genetic information and biological samples could be transferred.
The bankruptcy court rejected the objection. A federal district court also ruled against California's challenge.
The state pursued an appeal before agreeing in October 2026 to settle its claims against the former company. That settlement remained subject to court approval when announced.
Strip away the legal complexity and the central problem is unmistakable.
Customers submitted their genetic information to one corporate organization. Years later, the organization experienced financial collapse, and that information transferred to another legal entity through bankruptcy proceedings.
Customers retained deletion rights, but the transfer was not made conditional on obtaining fresh affirmative permission from every affected individual.
That is a very different arrangement from the ordinary understanding of personal consent.
In Baker's defense, he explicitly warned that companies could be sold and privacy policies could change.
He understood the theoretical possibility.
What he underestimated was its importance.
A company's financial survival is not an unrelated business consideration when its assets include biological information that customers cannot replace.
The bankruptcy exposed an uncomfortable question: How meaningful is control over personal genetic data when an ownership transfer can proceed without obtaining every customer's renewed agreement?
The issue is especially difficult because customers cannot change their inherited DNA after deciding that they no longer trust its custodian.
3. “Anonymous” Genetic Information Is Not Automatically Unidentifiable
Baker reassured viewers that research information could be shared without their names attached.
The implication was that removing personal identifiers made the arrangement sufficiently safe.
That description omitted an essential distinction.
Information can be stripped of someone's name without becoming impossible to connect to that person.
Scientists had demonstrated this problem years before Baker's review.
A 2018 study published in Science, led by Yaniv Erlich and colleagues, examined genetic genealogy records involving 1.28 million people.
The researchers estimated that approximately 60% of searches involving individuals of European ancestry could identify a third cousin or closer relative.
Combining those relationships with demographic information could substantially narrow the search for an individual's identity.
The study also demonstrated the identification of participants in a public genetic research project.
This does not establish that someone could routinely identify every participant in 23andMe's protected research databases.
The study involved particular matching methods and data-access conditions. Its findings cannot simply be transferred to every commercial research arrangement.
But it established something Baker's reassurance neglected: removing names does not eliminate every route to identification.
There was another important omission.
23andMe's research program distinguished between aggregated research results and de-identified information relating to individual participants.
Under a separate consent arrangement, customers could authorize the sharing of individual-level genetic and self-reported information with approved research collaborators.
The distinction existed before Baker's video. In its own earlier explanation of privacy practices, 23andMe described this additional consent and emphasized that customers could decline it.
The company's consent documentation also acknowledges that sharing individual-level information creates additional exposure because data may be stored in more locations.
It expressly warns that combining leaked research information with other databases could create identification risks.
This is not proof of improper research sharing.
Customers must separately consent to individual-level disclosure, and the company describes safeguards governing approved collaborators.
The criticism is that Baker compressed materially different arrangements into a reassuring generalization about anonymous research data.
A consumer deserves to understand whether information is aggregated, whether individual records are shared, who can access them, and what happens after they leave the original company.
Those questions are not bureaucratic complications.
They determine what the customer has actually agreed to.
4. Even 23andMe Admits That Deletion Cannot Undo Everything
Baker described the ability to delete genetic data and destroy biological samples as a significant privacy safeguard.
He was correct that such controls existed.
They remain important.
Following the company's bankruptcy, California's Attorney General specifically reminded customers that they could request deletion of their information, destruction of stored samples, and withdrawal of research consent.
But deletion deserves a more precise explanation than the video supplied.
According to 23andMe's research-consent documentation, withdrawing from research does not reverse work already performed.
Information already incorporated into a study cannot necessarily be withdrawn from that study, and previously shared individual-level information cannot simply be recalled from outside collaborators.
The company also states that withdrawing consent may take up to 30 days to prevent future individual-level sharing.
Then there is the obvious problem of theft.
Deleting an account after a breach does not recover information already stolen by an attacker.
Nor does destroying a retained saliva sample erase copies of genetic information that may already have been disclosed through authorized research arrangements.
These distinctions change the meaning of customer control.
A deletion button is valuable before information spreads beyond the systems that honor it.
Afterward, its protective power is more limited.
Baker presented deletion as one reason customers could feel comfortable submitting their DNA.
The more accurate explanation would have been that customers have some control over continued retention and future uses, but they cannot necessarily reverse every previous disclosure.
A person can cancel a subscription.
They cannot cancel their genome.
5. The Law Does Not Protect Genetic Information as Completely as the Video Implies
Baker cited the United States Genetic Information Nondiscrimination Act of 2008 as another reason not to worry excessively about commercial DNA testing.
The law does provide important protections.
It restricts genetic discrimination in health insurance and employment.
But there is a substantial qualification.
GINA does not generally protect consumers seeking life insurance, disability insurance, or long-term care insurance.
The National Human Genome Research Institute explicitly identifies these limits. Additional protections may exist under individual state laws, but the federal statute does not cover every insurance market.
This matters when companies provide reports predicting serious illnesses.
Baker's own Nebula Genomics results placed him in the 99th percentile for genetic susceptibility to rheumatoid arthritis, a condition he already had.
He correctly explained that genetic risk scores do not establish whether someone will develop a disease.
But the existence of predictive information creates questions about how insurers outside GINA's protections might use it where permitted by applicable law.
Baker's discussion of law enforcement was also too simple.
He suggested that police would generally need a warrant to obtain genetic information.
23andMe's published law-enforcement guidance describes a more complicated framework, including valid subpoenas, court orders, and search warrants, depending on the information requested and applicable legal requirements.
The company says it scrutinizes requests and resists inappropriate disclosure. Its customer guidance also states that it has not released customer information to law enforcement.
Those safeguards deserve recognition.
But the distinction between a warrant, a subpoena, and another valid legal process is consequential. They are not interchangeable protections.
Baker also acknowledged that FamilyTreeDNA operated differently.
Its investigative genetic genealogy system allows customers who opt in to participate in matching that may help authorized law-enforcement investigations.
The broader point is straightforward.
Genetic privacy depends on multiple overlapping rules: contractual promises, consent settings, applicable privacy laws, insurance regulations, and law-enforcement procedures.
A reassuring summary that treats these protections as universal leaves readers less informed than they should be.
6. The Review Asked Which DNA Test Was Best. It Should Also Have Asked Whether the Company Was Worth Trusting.
There is a reason Baker's video remains useful.
He actually tested the products.
His comparison documented disagreements in ancestry estimates, different customer databases, distinctive health-reporting features, and significant differences in price.
He also acknowledged his affiliate commissions and complimentary review kits.
None of this establishes dishonest intent.
The video was an earnest consumer comparison with a conspicuous weakness in its privacy analysis.
But that weakness matters because the commercial incentives surrounding genetic testing are unusual.
A customer may pay once for a testing kit.
The company may retain valuable genetic information for years, operate research programs using consenting participants' data, and build databases whose value depends partly on their scale.
The transaction does not necessarily end when the ancestry report arrives.
For customers, the purchase may feel temporary.
For the company, the relationship can continue long afterward.
That difference becomes particularly important when the company needs new investors, searches for a buyer, or enters bankruptcy.
In April 2025, privacy authorities from the United Kingdom and Canada expressed concerns about the protection of 23andMe customer information during its bankruptcy proceedings.
They specifically noted that a purchaser's promise to follow an existing privacy policy could be weakened if that policy could subsequently be amended.
The subsequent TTAM transaction included stronger commitments than a simple promise to maintain the old policy.
That is a genuine improvement.
It also illustrates why independent oversight, enforceable obligations, and explicit consent matter more than comforting language on a corporate website.
The costs of failed protection have now become concrete.
A court-approved consumer class-action settlement arising from the 2023 breach reached $46.75 million in July 2026, with payments to approved claimants issued in September.
California separately announced its $6 million settlement in October, although that agreement was still awaiting court approval.
These arrangements address legal claims and consumer remedies; they do not mean every allegation in every complaint has been judicially proven.
Money can compensate some losses.
It cannot reliably retrieve stolen genetic information.
Nor can it provide a biological equivalent of resetting a compromised password.
The Verdict: UsefulCharts Reviewed the Product. It Underestimated the Permanent Transaction.
Matt Baker's scientific explanations were frequently more careful than his privacy conclusions.
He warned viewers that genetic predisposition was not destiny. He explained why ancestry estimates differed. He distinguished specialized lineage research from general genealogical matching.
But his privacy analysis offered reassurance where the subject demanded much greater skepticism.
The subsequent history of 23andMe does not make every statement in his 2022 review false.
His warning about changing corporate ownership was prescient. His descriptions of important consumer rights were substantially grounded in real policies. And the company that eventually acquired 23andMe accepted meaningful restrictions on its handling of customer information.
Yet the central reassurance did not survive contact with reality.
A major breach exposed millions of profiles. A bankruptcy brought customer genetic information into an asset sale. Regulators challenged whether the transfer respected consumers' rights. Years of legal proceedings and substantial settlements followed.
All of this happened while the underlying genetic information remained fundamentally irreplaceable.
The fundamental mistake was treating genetic privacy as another feature in a product comparison.
For a conventional consumer purchase, the question is whether a product delivers enough value for its price.
For genetic testing, there is an additional question: whether the institution receiving the information can be trusted to protect it through technical failures, management changes, financial distress, and future ownership transfers.
That is a much harder question than deciding which company produces the prettiest ancestry chart.
Baker told his audience to keep an open mind about genetic testing.
He should have encouraged them to keep a more suspicious eye on the companies collecting their DNA.
Because the most important result of a consumer genetic test may not be the information the company gives you.
It may be the information you can never fully take back.
References
1. Original work under review
I Took 10 DNA Tests and Compared Them | Which One Should You Take? — UsefulCharts, Matt Baker, 2022.
The original consumer comparison contains Baker's testing results, recommendations, privacy assurances, and explicit qualifications. The supplied transcript was used to establish his statements.
2. California Department of Justice — May 28, 2026
Attorney General Bonta Sues Chrome Holding Co., Formerly Known as 23andMe, Over 2023 Data Breach
Details California's investigation, the approximately 14,000 directly compromised accounts, the broader exposure of nearly seven million profiles, and allegations of security failures and misleading statements. The complaint's allegations are not equivalent to final judicial findings.
3. 23andMe SEC filing — 2024
23andMe Form 10-Q, period ended December 31, 2023
Provides the company's contemporaneous description of credential stuffing and the resulting compromise of DNA Relatives and Family Tree information.
4. California Department of Justice — October 19, 2026
Attorney General Bonta Secures $6 Million Settlement in 23andMe Litigation
Documents the announced settlement, California's objections to the genetic-data transfer during bankruptcy, and customers' continuing deletion rights. Court approval of the settlement was pending when announced.
5. 23andMe — June 13 and July 14, 2025
Agreement for Sale to TTAM Research Institute
Completion of TTAM's Acquisition
Establishes the $305 million transaction, the buyer's identity, the acquisition's completion, and the privacy obligations the purchaser agreed to undertake.
6. Michigan Attorney General — July 14, 2026
Multistate Settlement of Bankruptcy Claims Against 23andMe
Identifies security deficiencies uncovered in the multistate investigation and describes additional safeguards imposed on the successor organization.
7. Erlich and colleagues — Science, October 11, 2018
Identity Inference of Genomic Data Using Long-Range Familial Searches
Provides peer-reviewed evidence that genetic relationships and demographic information can enable identification without direct access to a person's name. Its findings depend on the availability and composition of searchable databases.
8. 23andMe — Research consent documentation
Individual Data Sharing Consent
Research Participation and Consent
Explains the distinction between aggregate research findings and de-identified individual-level data, the additional consent required for individual-level sharing, and the limits of withdrawing information from existing research.
9. National Human Genome Research Institute — GINA
Genetic Information Nondiscrimination Act
Explains the federal protections against genetic discrimination and their limits, particularly regarding insurance outside health coverage.
10. 23andMe — Law Enforcement Guide
Describes the company's stated approach to subpoenas, warrants, court orders, customer notification, and disclosure requests.
11. UK Information Commissioner's Office and Office of the Privacy Commissioner of Canada — April 28, 2025
Joint Letter on Privacy Protection During 23andMe Bankruptcy Proceedings
Documents regulators' concerns about protecting genetic information through bankruptcy and the limitations of promises to follow privacy policies that might later change.
12. Court-authorized consumer settlement website — 2026
In re: 23andMe Customer Data Security Breach Litigation
Confirms approval of the $46.75 million consumer settlement and the September 2026 distribution of payments to approved claimants.