23andMe accused of failing to protect user data in new lawsuit
The lawsuit alleges the genetic testing company failed to protect user data.
The genetic testing company 23andMe is being sued by the state of California over allegations it failed to protect user data during a breach that affected millions of customers.
Attorney General Rob Bonta filed the lawsuit Thursday in San Francisco Superior Court against Chrome Holding Co., the corporate debtor name that 23andMe operated under during its bankruptcy process last year.
Last July, a bankruptcy court approved the $305 million sale of 23andMe to a nonprofit organization, TTAM Research Institute, led by the company's former CEO Anne Wojcicki.
The lawsuit alleges that hackers were able to operate inside the company's systems for five months during an alleged data breach in 2023, accessing data linked to nearly seven million users.
According to allegations in court documents, 23andMe detected more than one million log in attempts to a single customer account in one day, but failed to act.
The lawsuit also claims 23andMe downplayed the breach, saying the company was doing everything possible to protect customers' data while hackers were already selling information, including ancestry and genetic health details on the dark web.
At the time of the breach, 23andMe said that customer profile information shared through the company's DNA Relatives feature had been accessed without authorization.
Following the breach, 23andMe said a two-step verification for logging in was required as well as new customer passwords.
23andMe also agreed to pay a $30 million cash settlement in a class-action lawsuit stemming from the data breach, according to The Associated Press.
ABC News has reached out to 23andMe and an attorney for Chrome Holding Co. for comment on the lawsuit, which seeks several civil penalties against the company.
Founded in 2006 in San Francisco, 23andMe helped pioneer consumer genetic testing but faced difficulty turning the service into a sustainable business. The company's DNA kits use a saliva sample to extract DNA that is then analyzed for health and ancestry reports, according to the company's website.