23andMe successor settles with California for $6 million over cybersecurity failings
California's attorney general reached a $6 million settlement with 23andMe's successor company over claims that 23andMe failed to adequately secure customer data before a breach in 2023. The settlement resolves state allegations tied to the company's cybersecurity practices at the time of the incident.
Why this matters: 23andMe did not hold ordinary customer data. It held DNA. People gave that company their genetic information, which links directly to their health, ancestry, and living relatives. You cannot change your genome after a breach the way you change a password. A $6 million settlement is a modest consequence for a company that collected some of the most personal data imaginable and did not protect it well enough. The people whose data leaked have no real remedy. The fine does not get their privacy back.
Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance
This summary is AI-assisted and may contain errors. It is an original briefing to help you gauge significance quickly — not a reproduction of the source. Always read the linked original before relying on it. See our methodology.