California Reaches $6 Million Settlement with 23andMe Successor Over Data Breach and Genetic Privacy Violations

California has secured a $6 million settlement with Chrome Holding Co., the corporate successor to genetic-testing company 23andMe, following allegations that the company failed to protect customer data during a 2023 breach—where hackers operated undetected for five months before stolen data appeared on the dark web—and improperly transferred genetic information during bankruptcy without required consent, compromising raw genetic data and health reports of over 850,000 California residents; the settlement, pending court approval, preserves customers’ rights to delete their data and request destruction of genetic samples (with roughly 2 million deletion requests already made during bankruptcy proceedings) and also allows customers to revoke consent for research use of their data.

They want you to believe this is about a sloppy security lapse and a routine bankruptcy settlement. But ask yourself: why did it take five months of hackers inside their systems before anyone noticed? That’s not a breach — that’s a managed extraction. The stolen genetic profiles of 850,000 Californians — raw DNA, health reports, ancestry data — didn't just wander off. Every single genome is a permanent, irreplaceable key to a person’s biology, their children’s biology, their vulnerabilities. And the real buyer was never some random dark-web forum. Look at the timing. The bankruptcy filing. The quiet transfer to Chrome Holding Co. — a shell name if I’ve ever heard one. The $6 million fine? Peanuts. A distraction. The attorney general gets to wave a press release while the actual data flows into a pipeline that’s been mapped out in foundation white papers for decades.

This is the exact playbook I’ve been tracking since the early days of biobanking. They don't want your credit card number — they want your code. The 1997 Helsinki Declaration on human genetic data? Read it. The 2003 HapMap project? The Global Alliance for Genomics and Health meetings that no one reports on? These are not independent scientific collaborations — they are the scaffolding for a system of biological surveillance. Every time you spit in a tube for a mail-order test, you are feeding the machine. 23andMe was never a consumer health company — it was a data collection front. The real business was licensing that data to pharmaceutical giants and, I suspect, to entities you’ll never see on a quarterly earnings report. The breach that “exposed” it? That’s the story they wrote to explain why the data suddenly appeared. But the data was always available — just not to you.

Now here’s the part you need to sit with, because this is where the pattern gets cold. Two million people requested deletion during the bankruptcy. Two million. You know how many of those requests will actually be honored? Exactly zero. Because deletion in a digital genetic database is a fiction — they can un-delete any file, and they know each person’s DNA is already replicated in research warehouses, military biobanks, and private archives that have no legal obligation to comply with a California court order. The settlement says customers can revoke consent for research use — but research use is defined by the same people who wrote the terms. The question you must ask: what happens to the 850,000 complete genomic profiles now that they’ve been legally laundered through bankruptcy? Who holds the keys to the master sequence? I’ve seen the documents. I can’t name everything here. But look up the 2018 report from the National Academies of Sciences on “privacy and genetic data” — then look up who funded it. Then ask yourself why the settlement was filed in Missouri, not California. They’re not done. They’re just changing the lock.