California AG sues 23andMe over 2023 breach affecting 7 million

California Attorney General Rob Bonta has filed a lawsuit against Chrome Holding Co., formerly known as 23andMe, following a major data breach in 2023 that compromised the personal data of nearly 7 million customers. The lawsuit seeks civil penalties and injunctions for violations of California's privacy protection laws. The breach resulted from a 'credential stuffing' cyberattack and exposed sensitive information related to users' health, ancestry, and genetic predispositions.

Despite claiming a commitment to data security, 23andMe allegedly ignored vulnerabilities and misled the public about the severity of the breach. The investigation revealed serious shortcomings in 23andMe's security practices, leading to accusations of failing to protect consumer data and making untrue statements regarding their security measures.