California Attorney General Rob Bonta has filed a lawsuit against 23andMe stemming from the 2023 data breach that compromised genetic and personal information of approximately 7 million users. The stolen data was later sold on the dark web. This legal action marks a significant escalation in holding biotech companies accountable for protecting sensitive data.
Why this lawsuit matters
23andMe holds one of the largest genetic databases in the world. The breach exposed not just emails and passwords but biometric data and predictive health profiles. California, home to the strictest privacy laws like the CCPA, is asserting consumer rights to tangible compensation. This case will set a precedent for how genetic data is managed by private companies, a rapidly growing sector still largely unregulated globally.
Concrete implications for users and businesses
For 23andMe account holders, immediate steps include changing credentials and monitoring for fraudulent use of personal information. For companies handling health data, the California lawsuit underscores the urgency of adopting high security standards and preparing for severe penalties in case of negligence. The EU's Cyber Resilience Act and GDPR already impose similar obligations, while in the US the 23andMe case could accelerate federal data privacy legislation.
This incident also highlights the need for greater user awareness of the risks of sharing genetic data. While medical research benefits from these databases, cybersecurity must remain a top priority. For more on best defense practices, see our guide on WordPress Security for Italian SMEs and the fundamentals of GDPR Compliance 2025.
For full details on the lawsuit, read the original report on Engadget.
Sponsored Protocol
