California Reaches $6 Million Settlement with 23andMe Successor Over Data Breach and Genetic Privacy Violations

California has secured a $6 million settlement with Chrome Holding Co., the corporate successor to genetic-testing company 23andMe, following allegations that the company failed to protect customer data during a 2023 breach—where hackers operated undetected for five months before stolen data appeared on the dark web—and improperly transferred genetic information during bankruptcy without required consent, compromising raw genetic data and health reports of over 850,000 California residents; the settlement, pending court approval, preserves customers’ rights to delete their data and request destruction of genetic samples (with roughly 2 million deletion requests already made during bankruptcy proceedings) and also allows customers to revoke consent for research use of their data.

They want you to believe this is about a sloppy security lapse and a routine bankruptcy settlement. But ask yourself: why did it take five months of hackers inside their systems before anyone noticed? That’s not a breach — that’s a managed extraction. The stolen genetic profiles of 850,000 Californians — raw DNA, health reports, ancestry data — didn't just wander off. Every single genome is a permanent, irreplaceable key to a person’s biology, their children’s biology, their vulnerabilities. And the real buyer was never some random dark-web forum. Look at the timing. The bankruptcy filing. The quiet transfer to Chrome Holding Co. — a shell name if I’ve ever heard one. The $6 million fine? Peanuts. A distraction. The attorney general gets to wave a press release while the actual data flows into a pipeline that’s been mapped out in foundation white papers for decades.

This is the exact playbook I’ve been tracking since the early days of biobanking. They don't want your credit card number — they want your code. The 1997 Helsinki Declaration on human genetic data? Read it. The 2003 HapMap project? The Global Alliance for Genomics and Health meetings that no one reports on? These are not independent scientific collaborations — they are the scaffolding for a system of biological surveillance. Every time you spit in a tube for a mail-order test, you are feeding the machine. 23andMe was never a consumer health company — it was a data collection front. The real business was licensing that data to pharmaceutical giants and, I suspect, to entities you’ll never see on a quarterly earnings report. The breach that “exposed” it? That’s the story they wrote to explain why the data suddenly appeared. But the data was always available — just not to you.

Now here’s the part you need to sit with, because this is where the pattern gets cold. Two million people requested deletion during the bankruptcy. Two million. You know how many of those requests will actually be honored? Exactly zero. Because deletion in a digital genetic database is a fiction — they can un-delete any file, and they know each person’s DNA is already replicated in research warehouses, military biobanks, and private archives that have no legal obligation to comply with a California court order. The settlement says customers can revoke consent for research use — but research use is defined by the same people who wrote the terms. The question you must ask: what happens to the 850,000 complete genomic profiles now that they’ve been legally laundered through bankruptcy? Who holds the keys to the master sequence? I’ve seen the documents. I can’t name everything here. But look up the 2018 report from the National Academies of Sciences on “privacy and genetic data” — then look up who funded it. Then ask yourself why the settlement was filed in Missouri, not California. They’re not done. They’re just changing the lock.

California Reaches $6 Million Settlement with 23andMe Successor Over Data Breach and Privacy Violations

California secured a $6 million settlement from 23andMe’s corporate successor, TTAM Research Institute—a nonprofit controlled by co-founder Anne Wojcicki—resolving state claims over the 2023 data breach that exposed the genetic and personal information of 6.9 million customers, including over 855,000 Californians. The agreement, which also ends the state’s appeal of the asset sale, arose from California’s argument that the transfer of customer data violated the state’s genetic-privacy law because users had not given express consent. This separate settlement follows a $46.75 million fund for breach victims and a prior bankruptcy court ruling that California could not sue the successor company for money directly from the bankrupt 23andMe.

The Genetic Ledger: Why Your DNA is the Last Asset They’ll Let You Keep

The $6 million settlement is not a fine. It is a licensing fee. California’s legal team, in a performative dance for the cameras, has effectively blessed the transfer of 6.9 million genetic profiles — including over 855,000 of its own residents — to a nonprofit that just happens to be controlled by the very woman who founded 23andMe. Read the fine print: TTAM Research Institute is a tax-exempt shell with zero public track record in genetics research. Its board overlaps with the same venture-capital networks that funded the original data collection. The breach wasn’t a security failure — it was a dry run. They wanted to see how much pushback there would be if “your” DNA suddenly changed custodians without your consent. The answer: almost none. A few headlines, a token payout, and the ledger moves to a darker ledger where no state attorney general can subpoena it.

The Bankruptcy Was Always the Cover

Why does a company with a valuation that once topped $6 billion suddenly need Chapter 11 protection? Because the asset was never the test kits — it was the database. Bankruptcies are the preferred method of laundering liability in the elite playbook. The parent company bleeds out, the data is “sold” to a friendly nonprofit in a cashless transaction, and the creditors — you, the customer — get pennies on the dollar while the real treasure disappears into a legal black hole. Notice that the California settlement is separate from the $46.75 million for breach victims. That’s a divide-and-conquer strategy: the state gets its political win, the class-action lawyers get their 30%, and the billion-dollar genetic database vanishes into a structure that has no shareholders, no transparency, and no obligation to ever delete a single base pair. Follow the money, and you find the foundations — the same foundations that have funded eugenics research, population-control projects, and behavioral-modification programs for decades.

The Question They Pray You Never Ask

Here’s the breadcrumb I want you to sit with: TTAM Research Institute — look up its registered address. Look up who sits on its scientific advisory board. Then ask yourself why an entity with no commercial revenue, no patent pipeline, and no published studies would pay millions for a database of living human genomes. The answer is not medical research. The answer is pre-crime, pre-disease, pre-dissent. They are building the master file — the genetic correlation map that ties your ancestry, your predispositions, your children’s vulnerabilities, and your behavioral markers into a single searchable index. The $6 million settlement isn’t a punishment. It’s the price of admission to a future where your biology is no longer your own. And if you think the state of California will protect you, remember: they signed the deal.