What happened
Chrome Holdings, the entity that carries 23andMe's debts and liabilities, has agreed to pay the state of California $6 million to settle litigation over the company's 2023 breach. The proposed agreement was filed on Monday in the US Bankruptcy Court for the Eastern District of Missouri and still needs court approval.
The breach affected nearly 7 million consumers, of whom 855,000 were in California. It came through credential stuffing, meaning attackers took usernames and passwords leaked elsewhere and replayed them against 23andMe accounts, reaching genetic and health related profile data through accounts that had reused passwords or had weak protection.
California sued in state court in May 2026, alleging the company violated consumer, privacy and business practice statutes by failing to protect personal information and genetic data. The settlement resolves that suit and also closes an appeal the state attorney general filed after a court denied his objection to the sale of Californians' genetic information and samples in the bankruptcy without their affirmative consent.
Two terms are worth reading closely. Affected consumers keep the right to request deletion of their information and destruction of their saliva samples. And this is the fourth payout in a widening set: $46.75 million approved in June to compensate breach victims, $18 million in July to settle with 43 other state attorneys general, and a 2.31 million pound fine from the UK Information Commissioner's Office in June 2025.
Why this is a GRC story
Credential stuffing is a control failure, and regulators now treat it that way. The attack was not exotic. It worked because password reuse met an authentication design that let it. Where a company holds data that cannot be reissued, such as a genome, the standard of care for authentication rises well above a password. Multi factor authentication, breach password checks and anomaly detection are not optional extras in that context.
Bankruptcy does not end the liability trail. The operating business was sold to a new entity while the old corporate shell kept the debts. California pursued the shell, and the settlement shows state regulators will follow the liabilities rather than the brand. Anyone advising on a distressed acquisition should treat unresolved privacy exposure as a balance sheet item, not a reputational one.
Deletion has to survive the corporate structure. The right to have samples destroyed is being written into a settlement because the customer cannot exercise it through an app anymore. That is what a data lifecycle failure looks like at the end: consent recorded years earlier, a company that no longer exists in its old form, and a court order as the only remaining deletion mechanism.
What to watch
Watch whether the court approves the terms as filed, and whether the deletion and sample destruction commitments come with a deadline and an auditor. A right without a verification step is a statement of intent.
The other thing to watch is aggregation. Four separate settlements for one breach, across two countries and 43 states, is the pattern for consumer data at scale. The cost of a breach is now a portfolio of proceedings with different clocks, and the record keeping has to be good enough to answer the same questions four times over several years.
Attribution: Analysis based on DataBreachToday and related public reporting. This article is original commentary, not a repost of the source material.