{"id":273,"date":"2026-05-29T15:19:38","date_gmt":"2026-05-29T15:19:38","guid":{"rendered":"https:\/\/crosscountrymovingteams.com\/?p=273"},"modified":"2026-05-29T15:19:38","modified_gmt":"2026-05-29T15:19:38","slug":"california-sues-23andme-over-alleged-lax-data-security-that-failed-to-protect-nearly-7-million-users-data-in-2023-breach","status":"publish","type":"post","link":"https:\/\/crosscountrymovingteams.com\/?p=273","title":{"rendered":"California sues 23andMe over alleged \u2018lax\u2019 data security that failed to protect nearly 7 million users\u2019 data in 2023 breach"},"content":{"rendered":"
\n

Attorney General Rob Bonta filed the lawsuit against Chrome Holding Co., which 23andMe rebranded under after\u00a0filing for bankruptcy\u00a0last March. 23andme is known for its direct-to-consumer DNA test kits that provided customers information on their ancestry and genetic predispositions for certain health conditions.<\/p>\n

Read more Meet the Black women on Fortune\u2019s Most Powerful Women list shaping business leadership<\/a><\/p>\n

The lawsuit calls for various civil penalties against 23andMe and injunctions blocking the company from further violations of California\u2019s privacy protection laws.<\/p>\n

\n
\n
<\/div>\n<\/div>\n<\/div>\n

The company has acknowledged that it suffered a major security breach in 2023 that resulted in about 14,000 accounts accessed, through which they were able to steal the data of nearly 7 million customers. The cyberattack utilized \u201ccredential stuffing,\u201d which takes advantage of customers\u2019 tendency to use weak or common passwords or reuse passwords between multiple accounts.<\/p>\n

Bonta\u2019s office said this was a well-known attack that businesses should know to guard against. The attackers used stolen user account credentials including ones from a massive data breach in October 2017 that affected MyHeritage, one of 23andMe\u2019s former partners. After that breach, 23andMe did not take common protocols such as asking customers to reset their passwords or use multifactor authentication.<\/p>\n

23andMe did not immediately respond to an emailed request for comment.<\/p>\n

\u201c23andMe\u2019s security measures were so lax that the threat actor was able to operate undetected within 23andMe\u2019s systems for over five months, and remarkably, 23andMe only began investigating after the threat actor offered the stolen user data for sale on the dark web and reached out to 23andMe to demand a ransom,\u201d prosecutors said in the complaint.<\/p>\n

\n
<\/div>\n<\/div>\n

In October 2023, the stolen data appeared for sale on the dark web, with the poster specifically touting that about 1.1 million consumers\u2019 data belonged to Asian-Pacific Islander and Ashkenazi Jewish users.<\/p>\n

\u201cThe sale of this data on the dark web took place amidst a period of mounting anti-Asian American and Pacific Islander and antisemitic hate and violence,\u201d Bonta said in a press release. \u201cThis is disturbing and incredibly dangerous.\u201d<\/p>\n

Read more Kenya suspends a U.S. plan to create a quarantine facility for Americans exposed to ebola<\/a><\/p>\n

\n
\n
<\/div>\n<\/div>\n<\/div>\n

Some of the data stolen included raw genetic data, health reports, DNA shared with other relatives, and locations and birth years of relatives.<\/p>\n

\n
<\/div>\n<\/div>\n

The lawsuit says that after notifying the public about the breach, 23andMe continued to mislead consumers about the severity of the breach and the company\u2019s role in it.<\/p>\n

\n
<\/div>\n<\/div>\n

The company has said it only found out about the breach in October 2023 when the stolen data was posted for sale on the dark web. However, the lawsuit said the company failed to properly investigate red flags that appeared months earlier, such as a \u201csuspicious spike in user login attempts\u201d in July and a Reddit post discussing a possible breach and sale of user data in August.<\/p>\n

Genetic data requires \u201cone of the highest levels of protection\u201d and California law \u201cmandates a heightened legal obligation\u201d to protect it, the lawsuit said.<\/p>\n

Bonta also intervened to ensure customers\u2019 genetic data wouldn\u2019t be mishandled during 23andMe\u2019s Chapter 11 bankruptcy and asset sale, arguing that California\u2019s Genetic Information Privacy Act required companies to obtain opt-in consent from customers before selling their genetic information to third parties. However, the sale was allowed to proceed.<\/p>\n

In 2024, 23andMe agreed to pay a $30 million settlement in a class-action lawsuit accusing the company of failing to protect customers whose personal information was exposed in the breach. The amount was raised to $50 million to resolve most U.S. customer claims and received final approval in January by a federal judge overseeing 23andMe\u2019s bankruptcy.<\/p>\n

Read more Scott Bessent confirms a $250 bill with Trump on it has a prepared design<\/a><\/p>\n

\n
\n
<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

23andMe agreed to pay a $50 million settlement in a class-action lawsuit accusing the company of failing to protect customers whose personal information was exposed in the breach.<\/p>\n","protected":false},"author":1,"featured_media":272,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[82],"tags":[],"class_list":["post-273","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-lawsuit"],"yoast_head":"\nCalifornia sues 23andMe over alleged \u2018lax\u2019 data security that failed to protect nearly 7 million users\u2019 data in 2023 breach - Cross Country Moving Team<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/crosscountrymovingteams.com\/?p=273\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"California sues 23andMe over alleged \u2018lax\u2019 data security that failed to protect nearly 7 million users\u2019 data in 2023 breach - Cross Country Moving Team\" \/>\n<meta property=\"og:description\" content=\"23andMe agreed to pay a $50 million settlement in a class-action lawsuit accusing the company of failing to protect customers whose personal information was exposed in the breach.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/crosscountrymovingteams.com\/?p=273\" \/>\n<meta property=\"og:site_name\" content=\"Cross Country Moving Team\" \/>\n<meta property=\"article:published_time\" content=\"2026-05-29T15:19:38+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/crosscountrymovingteams.com\\\/?p=273#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/crosscountrymovingteams.com\\\/?p=273\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\\\/\\\/crosscountrymovingteams.com\\\/#\\\/schema\\\/person\\\/1b8121bfb9a1c55d1fff3fca675fceaa\"},\"headline\":\"California sues 23andMe over alleged \u2018lax\u2019 data security that failed to protect nearly 7 million users\u2019 data in 2023 breach\",\"datePublished\":\"2026-05-29T15:19:38+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/crosscountrymovingteams.com\\\/?p=273\"},\"wordCount\":637,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/crosscountrymovingteams.com\\\/?p=273#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/crosscountrymovingteams.com\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/5e125939312739bf8a8282eb3d396bf6.webp\",\"articleSection\":[\"Lawsuit\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/crosscountrymovingteams.com\\\/?p=273#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/crosscountrymovingteams.com\\\/?p=273\",\"url\":\"https:\\\/\\\/crosscountrymovingteams.com\\\/?p=273\",\"name\":\"California sues 23andMe over alleged \u2018lax\u2019 data security that failed to protect nearly 7 million users\u2019 data in 2023 breach - Cross Country Moving Team\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/crosscountrymovingteams.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/crosscountrymovingteams.com\\\/?p=273#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/crosscountrymovingteams.com\\\/?p=273#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/crosscountrymovingteams.com\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/5e125939312739bf8a8282eb3d396bf6.webp\",\"datePublished\":\"2026-05-29T15:19:38+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/crosscountrymovingteams.com\\\/#\\\/schema\\\/person\\\/1b8121bfb9a1c55d1fff3fca675fceaa\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/crosscountrymovingteams.com\\\/?p=273#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/crosscountrymovingteams.com\\\/?p=273\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/crosscountrymovingteams.com\\\/?p=273#primaryimage\",\"url\":\"https:\\\/\\\/crosscountrymovingteams.com\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/5e125939312739bf8a8282eb3d396bf6.webp\",\"contentUrl\":\"https:\\\/\\\/crosscountrymovingteams.com\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/5e125939312739bf8a8282eb3d396bf6.webp\",\"width\":1200,\"height\":600},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/crosscountrymovingteams.com\\\/?p=273#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/crosscountrymovingteams.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"California sues 23andMe over alleged \u2018lax\u2019 data security that failed to protect nearly 7 million users\u2019 data in 2023 breach\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/crosscountrymovingteams.com\\\/#website\",\"url\":\"https:\\\/\\\/crosscountrymovingteams.com\\\/\",\"name\":\"Cross Country Moving Team\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/crosscountrymovingteams.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/crosscountrymovingteams.com\\\/#\\\/schema\\\/person\\\/1b8121bfb9a1c55d1fff3fca675fceaa\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/50b1ad2e498f523425ee0a8cc5180a210646db1622662a3d56cc405d3e0c346a?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/50b1ad2e498f523425ee0a8cc5180a210646db1622662a3d56cc405d3e0c346a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/50b1ad2e498f523425ee0a8cc5180a210646db1622662a3d56cc405d3e0c346a?s=96&d=mm&r=g\",\"caption\":\"admin\"},\"sameAs\":[\"http:\\\/\\\/crosscountrymovingteams.com\"],\"url\":\"https:\\\/\\\/crosscountrymovingteams.com\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"California sues 23andMe over alleged \u2018lax\u2019 data security that failed to protect nearly 7 million users\u2019 data in 2023 breach - Cross Country Moving Team","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/crosscountrymovingteams.com\/?p=273","og_locale":"en_US","og_type":"article","og_title":"California sues 23andMe over alleged \u2018lax\u2019 data security that failed to protect nearly 7 million users\u2019 data in 2023 breach - Cross Country Moving Team","og_description":"23andMe agreed to pay a $50 million settlement in a class-action lawsuit accusing the company of failing to protect customers whose personal information was exposed in the breach.","og_url":"https:\/\/crosscountrymovingteams.com\/?p=273","og_site_name":"Cross Country Moving Team","article_published_time":"2026-05-29T15:19:38+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"admin","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/crosscountrymovingteams.com\/?p=273#article","isPartOf":{"@id":"https:\/\/crosscountrymovingteams.com\/?p=273"},"author":{"name":"admin","@id":"https:\/\/crosscountrymovingteams.com\/#\/schema\/person\/1b8121bfb9a1c55d1fff3fca675fceaa"},"headline":"California sues 23andMe over alleged \u2018lax\u2019 data security that failed to protect nearly 7 million users\u2019 data in 2023 breach","datePublished":"2026-05-29T15:19:38+00:00","mainEntityOfPage":{"@id":"https:\/\/crosscountrymovingteams.com\/?p=273"},"wordCount":637,"commentCount":0,"image":{"@id":"https:\/\/crosscountrymovingteams.com\/?p=273#primaryimage"},"thumbnailUrl":"https:\/\/crosscountrymovingteams.com\/wp-content\/uploads\/2026\/05\/5e125939312739bf8a8282eb3d396bf6.webp","articleSection":["Lawsuit"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/crosscountrymovingteams.com\/?p=273#respond"]}]},{"@type":"WebPage","@id":"https:\/\/crosscountrymovingteams.com\/?p=273","url":"https:\/\/crosscountrymovingteams.com\/?p=273","name":"California sues 23andMe over alleged \u2018lax\u2019 data security that failed to protect nearly 7 million users\u2019 data in 2023 breach - Cross Country Moving Team","isPartOf":{"@id":"https:\/\/crosscountrymovingteams.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/crosscountrymovingteams.com\/?p=273#primaryimage"},"image":{"@id":"https:\/\/crosscountrymovingteams.com\/?p=273#primaryimage"},"thumbnailUrl":"https:\/\/crosscountrymovingteams.com\/wp-content\/uploads\/2026\/05\/5e125939312739bf8a8282eb3d396bf6.webp","datePublished":"2026-05-29T15:19:38+00:00","author":{"@id":"https:\/\/crosscountrymovingteams.com\/#\/schema\/person\/1b8121bfb9a1c55d1fff3fca675fceaa"},"breadcrumb":{"@id":"https:\/\/crosscountrymovingteams.com\/?p=273#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/crosscountrymovingteams.com\/?p=273"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/crosscountrymovingteams.com\/?p=273#primaryimage","url":"https:\/\/crosscountrymovingteams.com\/wp-content\/uploads\/2026\/05\/5e125939312739bf8a8282eb3d396bf6.webp","contentUrl":"https:\/\/crosscountrymovingteams.com\/wp-content\/uploads\/2026\/05\/5e125939312739bf8a8282eb3d396bf6.webp","width":1200,"height":600},{"@type":"BreadcrumbList","@id":"https:\/\/crosscountrymovingteams.com\/?p=273#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/crosscountrymovingteams.com\/"},{"@type":"ListItem","position":2,"name":"California sues 23andMe over alleged \u2018lax\u2019 data security that failed to protect nearly 7 million users\u2019 data in 2023 breach"}]},{"@type":"WebSite","@id":"https:\/\/crosscountrymovingteams.com\/#website","url":"https:\/\/crosscountrymovingteams.com\/","name":"Cross Country Moving Team","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/crosscountrymovingteams.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/crosscountrymovingteams.com\/#\/schema\/person\/1b8121bfb9a1c55d1fff3fca675fceaa","name":"admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/50b1ad2e498f523425ee0a8cc5180a210646db1622662a3d56cc405d3e0c346a?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/50b1ad2e498f523425ee0a8cc5180a210646db1622662a3d56cc405d3e0c346a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/50b1ad2e498f523425ee0a8cc5180a210646db1622662a3d56cc405d3e0c346a?s=96&d=mm&r=g","caption":"admin"},"sameAs":["http:\/\/crosscountrymovingteams.com"],"url":"https:\/\/crosscountrymovingteams.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/crosscountrymovingteams.com\/index.php?rest_route=\/wp\/v2\/posts\/273","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crosscountrymovingteams.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crosscountrymovingteams.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crosscountrymovingteams.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crosscountrymovingteams.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=273"}],"version-history":[{"count":0,"href":"https:\/\/crosscountrymovingteams.com\/index.php?rest_route=\/wp\/v2\/posts\/273\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/crosscountrymovingteams.com\/index.php?rest_route=\/wp\/v2\/media\/272"}],"wp:attachment":[{"href":"https:\/\/crosscountrymovingteams.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=273"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crosscountrymovingteams.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=273"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crosscountrymovingteams.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=273"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}