A lawsuit has been filed against 23andMe by the California Attorney General for allegedly failing to secure sensitive genetic data after a 2023 breach that exposed information from nearly seven million users. The breach was attributed to old credential-stuffing techniques and a coding error in the DNA Relatives feature, which allowed attackers to access extensive user data.
Despite the breach affecting approximately 14,000 accounts directly, the lawsuit claims that the company's lack of reasonable security measures led to widespread data exposure. California is seeking damages, but the company, now under bankruptcy, poses challenges in terms of recovery. This case highlights the risks associated with sharing genetic data and the ongoing debate over user responsibility in data breaches.