23andMe’s Privacy Promise Met a Data Breach, Bankruptcy, and a $305 Million Sale
A DNA test can tell you where your ancestors came from. It cannot tell you who will control your genetic information after the company holding it gets hacked, runs out of money, and sells its assets.
That is the disturbing lesson of 23andMe.
In a March 2019 UsefulCharts video, Matt Baker offers a friendly demonstration of genetic genealogy. He collects saliva, explains ancestry percentages, traces paternal and maternal lineages, and shows how customers can discover relatives. His results largely agree with his family research. His son appears among his genetic matches, sharing approximately half his DNA.
The demonstration is useful and largely accurate. Its most important omission is the long-term risk attached to the service itself.
Baker tells viewers that genetic matching is voluntary: customers can decide whether their information appears to other users. That was a fair description of the feature in 2019. But it was not a complete explanation of what could happen once millions of people connected their family histories through a commercial database.
Four years later, attackers exploited that network to obtain information associated with nearly seven million customers. Two years after the breach, 23andMe entered bankruptcy. Its consumer genetics business and research operations were eventually acquired in a transaction valued at $305 million.
By October 2026, regulators had documented serious security failures, millions of affected customers had become eligible for a court-approved settlement, and California had announced another $6 million settlement addressing allegations concerning the breach and the transfer of customer data.
Baker could not reasonably have predicted these events in 2019. The criticism belongs primarily to the company whose systems and promises were later tested.
The larger problem is that a service built around discovering your family could expose information about that family far beyond the security of your own account.
The Feature That Made 23andMe Useful Also Made the Breach Enormous
One of the video's most appealing moments comes when Baker opens his DNA relatives page.
His son appears first. Below him are second cousins, more distant cousins, and people whose family connections he might otherwise never have discovered.
The service allows him to contact these individuals and investigate branches of his family tree.
That is a legitimate benefit. Genetic matching can provide information that traditional documents cannot.
But a family-matching database is fundamentally different from an ordinary customer database.
Your information does not exist in isolation. It becomes part of a network connecting you to other people through shared genetic ancestry.
In 2023, that distinction became catastrophic.
Attackers used a technique called credential stuffing: taking usernames and passwords compromised elsewhere and trying them against 23andMe accounts.
According to a joint investigation by the privacy regulators of Canada and the United Kingdom, attackers successfully accessed 18,222 customer accounts between April 29 and September 20, 2023.
That number initially appears modest compared with the company's millions of customers.
But 23andMe's DNA Relatives feature allowed individual accounts to display information about as many as 1,500 or 5,000 genetic matches, depending on the subscription.
By accessing thousands of accounts, attackers could reach the profiles of millions of additional users.
The investigation documented approximately 5.5 million compromised DNA Relatives profiles and nearly 1.47 million family-tree profiles, with different categories of affected information requiring care when counting individuals.
The central failure was not that every affected customer had a stolen password.
It was that compromising relatively few accounts opened access to information belonging to vastly more people.
This is the first major weakness in the simplified idea of genetic privacy presented in the original tutorial.
Baker correctly explains that users can choose whether to participate in relative matching. He does not promise that the system is immune to unauthorized access.
Yet the practical implication of opting in deserves much greater emphasis: your information becomes accessible through other people's accounts, not just your own.
A customer might use a unique password and follow every available security recommendation, yet still have information exposed because someone genetically connected to them had an account compromised.
The value of the service depends on building connections.
The danger comes from how many connections a single compromised account can expose.
23andMe Knew Stronger Security Was Necessary
The attackers did not need to invent a new method of breaking encryption or discover an extraordinary flaw in genetic technology.
They reused stolen passwords.
The Canadian and British investigation found that 23andMe had failed to implement adequate safeguards against a well-known form of attack.
Before the breach, stronger authentication was optional for customers.
Approximately 78% had not enabled either multifactor authentication or an alternative single-sign-on service.
That left passwords as their principal defense.
The company had taken stronger precautions for its own employees, including mandatory multifactor authentication for access to company systems. Customers holding sensitive genetic information did not receive the same mandatory protection.
The distinction is revealing.
23andMe understood that passwords alone were inadequate for some of its most sensitive systems. Yet it allowed most customers to depend on them.
The company explained to investigators that requiring additional authentication could create difficulties for users, particularly those with limited digital skills.
Convenience had become part of its security calculation.
The regulators rejected that justification. They concluded that mandatory stronger authentication would very likely have prevented the large-scale credential-stuffing attack.
The evidence becomes more uncomfortable when examined chronologically.
In August 2023, while the attacks were occurring, internal discussions among company developers acknowledged concerns about password security.
The company's chief product officer identified the need for stronger protections around account transfers and raw genetic data downloads.
Those discussions demonstrate that the problem was not beyond the company's technical understanding.
The protections were available. The risks were recognizable.
Customers remained exposed.
The failure extended beyond authentication.
Investigators found that 23andMe had access to a password-security service capable of checking credentials against a vast database of compromised passwords, but had not enabled that functionality.
The company also failed to detect patterns of suspicious logins during the attack.
Its security tools were not adequately configured to recognize what was happening.
The lesson is not that every successful cyberattack proves corporate negligence. Even well-protected organizations can be compromised.
It is that investigators identified specific, available protections that 23andMe had failed to use.
In June 2025, Britain's Information Commissioner's Office fined the company £2.31 million for failing to protect customers' personal information adequately.
The Attack Continued While Warning Signs Accumulated
A security failure becomes more consequential when a company has opportunities to recognize it and intervene.
23andMe had several.
On July 6, 2023, automated activity generated more than one million logins to the same account in a single day.
The activity temporarily crashed the platform.
Later that month, attackers attempted hundreds of account-profile transfers.
The company investigated and restricted those transfers, but did not connect the incidents to the broader credential-stuffing attack.
Then came an explicit warning.
On August 10, someone claiming to have breached 23andMe contacted the company and asserted that substantial customer information had been stolen.
The claim included extraordinary figures that were not independently established. Treating those figures skeptically would have been reasonable.
Treating the warning itself as unworthy of serious investigation was another matter.
Investigators found that 23andMe classified the claim as a hoax and closed the incident after four days.
The company did not obtain a sample of the allegedly stolen data at that time.
In October, after stolen information was advertised online, an outside specialist obtained a sample and confirmed that the breach was genuine.
The regulators concluded that a more thorough investigation in August could have enabled earlier intervention, potentially preventing the compromise of thousands of additional accounts in September.
This chronology matters more than any vague accusation that 23andMe was careless.
The attackers were active for months. The platform crashed. Suspicious account activity was identified. A person claimed to possess stolen information.
The company failed to connect the warnings before the breach became public.
The Difference Between Exposed Ancestry Profiles and Stolen Genomes
The scale of the breach invites an easy exaggeration: that hackers stole the complete genetic data of nearly seven million people.
The official investigation does not support that claim.
The affected information varied considerably.
For millions of customers, the exposed material included genetic-relative profiles, ancestry information, family-tree details, names, birth years, locations, and information about relationships.
For customers whose accounts were directly compromised, attackers could potentially access more sensitive material, including health reports and raw genetic data.
The regulators reported that 23andMe's later forensic analysis identified four individuals worldwide whose raw DNA data had been downloaded.
They also made clear that they had not independently verified that revised figure.
Other categories of access were broader, including thousands of affected health reports.
These distinctions are essential.
An ancestry profile is not equivalent to a complete raw genotype file.
But information about ethnicity, relatives, family relationships, and geographical location can still be highly sensitive.
The privacy regulators also rejected the company's argument that the social nature of DNA Relatives reduced the risk of harm.
A customer who agrees to share information with genetic matches has not agreed to have it collected by a criminal and offered for sale.
Nor can a customer exercise meaningful control over a copy already taken by an attacker.
The regulators found that the compromised information had not been recovered and that the breach created a serious risk of harm.
23andMe told investigators that it was unaware of affected individuals suffering actual harm. The regulators considered that relevant, but not sufficient to dismiss the risks.
This is the distinction that should guide any serious discussion of genetic privacy.
Consent to participate in a feature is not consent to criminal access.
And the ability to stop future sharing cannot reverse a past exposure.
Then the Company Went Bankrupt
In March 2025, 23andMe entered Chapter 11 bankruptcy proceedings.
Its financial problems introduced a second challenge to the idea that customers controlled their genetic information.
The first involved unauthorized access.
The second involved a legal transfer of business assets.
These were separate events with different causes and consequences. The bankruptcy did not constitute another data breach, and the legitimate buyer was not the criminal who had stolen customer information.
Nevertheless, both developments confronted customers with the same fundamental question:
Who controls the information after someone has provided it?
The company's privacy statement contemplated the possibility that personal information could be transferred during a bankruptcy, merger, acquisition, or asset sale.
In March 2025, Federal Trade Commission Chairman Andrew Ferguson wrote to the U.S. trustee overseeing the bankruptcy.
He emphasized the sensitivity of the company's genetic information, biological samples, medical information, family histories, and customer communications.
His central concern was that any purchaser should remain bound by the privacy commitments the company had made to customers.
The FTC letter did not declare that every transfer was unlawful.
It demanded continuity of the protections customers had been promised.
But consider what this meant in practical terms.
A customer might purchase a DNA test expecting a lasting relationship with one company.
Years later, that company's financial position could change.
Its business and associated customer information could become part of a bankruptcy sale.
The customer's initial decision to submit genetic information would remain consequential long after the testing kit had been discarded.
A $305 Million Transaction
In May 2025, biotechnology company Regeneron announced an agreement to acquire major 23andMe assets for $256 million.
The bidding process subsequently changed.
On June 13, 2025, 23andMe announced that TTAM Research Institute, a nonprofit public benefit corporation founded and led by 23andMe co-founder Anne Wojcicki, had won a further round of bidding.
The final purchase price was $305 million.
TTAM completed the acquisition of the consumer genetics and research businesses on July 14, 2025.
The price did not represent a separate valuation of customers' DNA alone.
The transaction encompassed operating businesses, research activities, intellectual property, and other assets.
Nevertheless, customer genetic information was an important component of what made the acquired operations valuable.
The striking feature of the transaction is that genetic information collected from consumers could remain commercially and scientifically significant even after the company that originally collected it became insolvent.
That is not proof of exploitation.
It is evidence that purchasing a genetic testing service can create a lasting relationship between a person's sensitive information and an institution's financial future.
California Tried to Stop the Transfer Without Fresh Consent
The bankruptcy also exposed a dispute over the meaning of consent.
California's Department of Justice objected to transferring customers' genetic information and biological samples without their separate, affirmative permission.
The state argued that the proposed transfer conflicted with California's Genetic Information Privacy Act.
The bankruptcy court rejected the objection.
A federal district court also rejected California's challenge.
The sale proceeded.
California continued its legal efforts, while separately pursuing allegations concerning the original company's security practices and representations to consumers.
On October 19, 2026, California Attorney General Rob Bonta announced a $6 million settlement with Chrome Holding Co., the former 23andMe corporate debtor.
The settlement addressed the breach-related allegations and resolved the state's continuing appeal concerning the genetic-data transfer.
At the time of the announcement, the settlement remained subject to bankruptcy-court approval.
The $6 million agreement should not be confused with the separate consumer class-action settlement arising from the breach.
The outcome deserves precision.
California did not establish through a final court ruling that the asset sale violated its genetic privacy law.
Its objections were rejected, and the eventual settlement resolved the remaining dispute.
But the disagreement exposed an important gap between two interpretations of consumer choice.
Under one interpretation, customers retain control because they can delete their information or withdraw from certain activities.
Under another, transferring sensitive genetic information to a new owner should require fresh, affirmative permission before the transfer occurs.
Those are not equivalent protections.
One gives people a chance to object.
The other requires their agreement.
The New Owner Made Privacy Commitments. They Matter.
The criticism would be incomplete without examining what the purchaser actually agreed to do.
TTAM committed to honoring existing deletion rights and research opt-out choices.
It also promised additional protections, including limits on certain future transfers, a privacy advisory board, privacy procedures and reporting, and identity-theft monitoring for customers.
The new organization continues to operate genetic testing and research services.
Its current privacy information describes account deletion, sample destruction, optional participation in genetic matching, and voluntary research consent.
Those commitments materially narrow the case against the acquisition.
The evidence does not establish that TTAM purchased the business to disregard customer consent, sell identifiable genetic information indiscriminately, or misuse the database.
Such accusations would require proof that is not present.
But the promises also clarify how much customers must rely on institutions to protect them.
A privacy policy can define legitimate uses.
A transfer agreement can bind a purchaser.
A regulator can impose penalties.
None of those safeguards can guarantee that a future security failure will never occur.
Nor can they retrieve stolen information already circulating outside the company's control.
The Settlement Cannot Put the Information Back
In January 2026, the bankruptcy court granted final approval to a class-action settlement concerning the 2023 breach.
In July, the court approved a final settlement amount of $46.75 million.
According to the court-authorized settlement administrator, payments for approved claims were issued on September 29 and 30, 2026.
The settlement covers approximately 6.4 million affected U.S. residents and provides different benefits depending on eligibility, including compensation for qualifying claims and privacy-monitoring services.
The settlement is an important legal development.
But compensation and recovery are different things.
An individual can receive money because information was exposed.
That payment does not erase the information.
The distinction is especially significant for genetic records.
A stolen credit card can be replaced.
A compromised password can be changed.
A person's genetic makeup cannot.
The resulting risk is not that every exposed ancestry estimate will inevitably cause serious harm. The evidence does not support such a sweeping prediction.
It is that genetic and family information can remain sensitive for decades, while future methods of analyzing or connecting information may change.
That makes prevention unusually important.
Once the information is outside a company's control, remedies become necessarily incomplete.
Deleting Your DNA Data Is Not the Same as Undoing the Past
California's October 2026 announcement also reminded customers that they could request deletion of genetic data and destruction of stored biological samples.
The Attorney General provided instructions for doing so through the account's settings.
Customers can separately withdraw permission for research participation.
These options are meaningful.
A person who no longer wants to participate in 23andMe's services should not be forced to maintain an account indefinitely.
But deletion has limits that the ordinary language of consumer control can obscure.
Deleting information from a company's systems does not compel an unknown criminal to delete a stolen copy.
Destroying a laboratory sample cannot remove information already extracted from it and exposed elsewhere.
Withdrawing consent for future research cannot necessarily undo every completed analysis or publication that previously relied on lawfully supplied information.
This is not an argument against deletion rights.
It is an argument against presenting those rights as though they restore the world to the moment before a person submitted their DNA.
They cannot.
The Question Baker's Tutorial Leaves Unanswered
Baker's video remains an effective explanation of consumer genetic genealogy.
His French and German ancestry estimates are useful examples of how DNA results can reinforce family research.
His discussion of broad regional categories correctly warns against treating every ancestry percentage as an exact identification.
His explanation of haplogroups also avoids a common error: confusing an ancient shared paternal lineage with proof of descent from a particular king.
The science and genealogical explanations are not the problem.
The problem is that the video treats DNA testing chiefly as a transaction between a curious individual and a helpful service.
A person sends saliva.
The company analyzes it.
The customer receives answers.
But genetic testing creates something more lasting than a report.
It establishes a record that can connect family members, reveal sensitive relationships, and remain valuable to researchers and businesses years after the original test.
The record can outlive the customer's interest in genealogy.
It can also outlive the corporate structure that first collected it.
By 2026, 23andMe's history had demonstrated both possibilities.
Millions of customers had information exposed through a criminal attack.
The business had subsequently passed through bankruptcy into new ownership.
Legal protections, regulatory penalties, contractual commitments, and settlements followed.
Those responses mattered. But they came after decisions that customers could not fully reverse.
The Verdict: The Customer Bought Answers. The Company Kept the Data.
The most serious criticism of 23andMe is not that genetic ancestry testing is worthless.
It plainly has value.
Baker's experience demonstrates that value through concrete family connections, plausible ancestry estimates, and information about distant lineages.
The failure lies in treating the experience of receiving genetic results as though it captures the consequences of providing the underlying information.
A customer sees percentages and relatives.
The company maintains a database.
That database requires security, governance, continuity, and trust across years of changing technology, ownership, and financial circumstances.
23andMe's history reveals how badly those responsibilities can be handled.
The 2023 breach exposed personal information associated with millions of people through an attack that regulators concluded could largely have been prevented.
The company's bankruptcy then forced a public legal argument about whether inherited privacy commitments were sufficient to justify transferring sensitive genetic information to a new owner.
There is no evidence that Baker intended to mislead viewers. His 2019 tutorial predates the failures examined here, and his explanation of genetic matching was substantially accurate.
But its reassuring picture of consumer choice is no longer sufficient.
The question is not simply whether someone wants to discover their ancestors. It is whether they are prepared to entrust information about themselves and their relatives to an institution whose security, ownership, and future they cannot control.
23andMe offered to help customers understand where they came from.
Its subsequent history makes the future of their genetic information a much more difficult question.
References
1. Original work — My 23andMe DNA Results. UsefulCharts, Matt Baker, March 15, 2019.
Watch the original video
The primary work demonstrates saliva collection, ancestry estimates, family matching, and haplogroups, including Baker's explanation of voluntary participation in DNA Relatives.
2. Joint Investigation into a Data Breach at 23andMe. Office of the Privacy Commissioner of Canada and UK Information Commissioner's Office, June 20, 2025.
Read the joint investigation
The regulators document the attack timeline, affected information, failures of prevention and detection, inadequate notifications, and the company's responses; some forensic figures could not be independently verified.
3. 23andMe Fined £2.31 Million for Failing to Protect UK Users' Genetic Data. UK Information Commissioner's Office, June 17, 2025.
Read the enforcement announcement
The regulator confirms the financial penalty and identifies inadequate security protections as a central cause of the 2023 breach.
4. Federal Trade Commission Chairman Andrew N. Ferguson Letter on 23andMe Bankruptcy Impact to Consumers. Federal Trade Commission, March 31, 2025.
Read the FTC letter
The letter identifies concerns over transferring genetic information and biological samples during bankruptcy and argues that purchasers must honor existing privacy commitments.
5. Regeneron Enters into Asset Purchase Agreement to Acquire 23andMe for $256 Million. Regeneron Pharmaceuticals, May 19, 2025.
Read the acquisition announcement
The announcement establishes the earlier acquisition proposal and explains why Regeneron ultimately did not complete the transaction.
6. 23andMe Reaches Agreement for Sale of Business to TTAM Research Institute. 23andMe, June 13, 2025.
Read the sale announcement
The announcement confirms the $305 million agreement, identifies the purchaser, and details the additional privacy commitments accompanying the transaction.
7. TTAM Research Institute Completes the Acquisition of 23andMe Assets. 23andMe Research Institute, July 14, 2025.
Read the completion announcement
The release confirms completion of the acquisition and identifies the genetic testing and research operations transferred to the new organization.
8. Attorney General Bonta Secures $6 Million Settlement in 23andMe Litigation. California Department of Justice, October 19, 2026.
Read the settlement announcement
The announcement explains California's challenge to the genetic-data transfer, the courts' rejection of its objections, the proposed settlement, and consumers' continuing deletion rights; the settlement was pending court approval when announced.
9. In re: 23andMe, Inc. Customer Data Security Breach Litigation. Court-authorized settlement administrator, updated 2026.
Open the settlement information
The administrator confirms court approval, the $46.75 million final amount, eligibility requirements, settlement benefits, and the September 2026 payment dates.
10. 23andMe Privacy Statement. 23andMe Research Institute, updated May 19, 2026.
Read the current privacy statement
The statement describes the successor organization's published commitments concerning account deletion, biological sample storage, authentication, genetic matching, and research participation.