23andMe Discloses 2023 Credential-Stuffing Breach Tied to Reused Passwords

California Attorney General Rob Bonta sued Chrome Holding Co., the successor company to 23andMe, in San Francisco Superior Court on Thursday, alleging violations of the California Consumer Privacy Act and the Genetic Information Privacy Act in connection with a 2023 data breach.

According to the complaint, hackers used credential stuffing to access approximately 14,000 accounts and obtained raw genetic data, health reports, DNA shared with relatives, locations and birth years of relatives, ancestry, ethnicity, and genetic predispositions and risk factors.

The breach affected nearly 7 million people nationwide, including more than 850,000 Californians. Personal information belonging to users of Ashkenazi Jewish and Asian-Pacific Islander descent later appeared for sale on the dark web.

The complaint states that a suspicious spike in login attempts occurred in July 2023. A Reddit post discussed a possible breach in August 2023. The company began investigating after the data was offered for sale and a ransom was demanded, according to the California Department of Justice investigation cited in the filing.

The threat actor operated undetected within 23andMe’s systems for over five months.

” The lawsuit alleges the company did not require customers to reset passwords or implement multifactor authentication after a 2017 MyHeritage breach that exposed credentials later used in the attack.

Chrome Holding Co. is a subsidiary of TTAM Research Institute, the nonprofit led by former 23andMe CEO Anne Wojcicki that acquired the company following its March 2025 Chapter 11 bankruptcy filing. Bonta had intervened in the bankruptcy proceedings to ensure genetic data would not be mishandled, citing the Genetic Information Privacy Act’s requirement for opt-in consent before selling such information to third parties.

The bankruptcy sale was allowed to proceed.