California AG Rob Bonta Secures $6 Million Settlement and Binding Security Mandates Over 23andMe Data Breach

California Attorney General Rob Bonta announced a comprehensive $6 million multi-state settlement on Tuesday resolving an extensive consumer privacy investigation into Mountain View-based genetic testing company 23andMe. The enforcement action stems from a massive 2023 credential-stuffing cyberattack in which threat actors compromised millions of user accounts, accessing sensitive ancestry reports, DNA relative matches, and personal health profile indicators.

Under the court-approved consent judgment filed in San Francisco Superior Court, 23andMe is legally required to implement sweeping cybersecurity overhauls, including mandatory hardware-backed multi-factor authentication for all customer accounts, continuous automated credential-stuffing defense software, and annual independent SOC-2 security audits for five consecutive years. The company must also maintain an explicit data deletion dashboard allowing customers to permanently purge genetic records from company servers within 30 days.

State consumer privacy regulators emphasized that biological and genetic data requires the highest possible threshold of digital protection because DNA profiles are immutable and cannot be replaced following a data compromise. State attorneys noted that approximately $2.8 million of the settlement funds will support the California Department of Justice's Consumer Privacy Protection Fund to investigate future corporate digital breaches and enforce California Consumer Privacy Act compliance.

Consumers, privacy advocates, and affected 23andMe customers can review the full consent decree terms, security verification checklists, and official consumer privacy complaint portals online at oag.ca.gov. Inquiries regarding consumer restitution procedures and identity protection resources may be submitted to the Attorney General's Public Inquiry Unit Monday through Friday at (800) 952-5225. Mandatory third-party security verification audits will begin within 90 days.