California Cannot Seek Damages From 23andMe Successor Over 2023 Data Breach

FILE PHOTO: Attendees visit the 23andMe booth at the RootsTech annual genealogical event in Salt Lake City, Utah, U.S., February 28, 2019. REUTERS/George Frey//File Photo

By Jonathan Stempel

July 10 (Reuters) – A U.S. bankruptcy ⁠judge ⁠on Friday said California cannot ⁠seek damages from the company formerly known as 23andMe arising ​from a 2023 data breach that exposed genetic and other personal information of an ‌estimated 6.9 million customers.

Read more New US, Canada Bridge to Open Soon, Michigan Republican Says

U.S. Bankruptcy ‌Judge Brian Walsh in St. Louis said 23andMe’s Chapter 11 reorganization plan precludes ⁠the ⁠state from pursuing monetary relief against Chrome Holding Co and an ​affiliate, though it could seek non-monetary remedies.

Walsh said California must either dismiss its May 28 lawsuit in San Francisco Superior Court within 14 days, or amend its complaint to ​eliminate the claims for monetary relief.

The decision is a defeat for California Attorney ⁠General ⁠Rob Bonta, who accused 23andMe ⁠of ​ignoring warnings that its systems were compromised and downplaying the breach’s severity. He has ​been seeking potentially millions ⁠of dollars in civil fines.

Bonta’s office did not immediately respond to requests for comment.

The attorney general argued that the U.S. Congress did not give bankruptcy judges power to prohibit state law-based enforcement actions in state courts, permitting bankruptcy courts to ⁠become “a haven for wrongdoers.”

But the judge “disagreed” that 23andMe’s reorganization plan created such ⁠a haven, and that even if it did, California could not attack it.

Read more Apple Sues OpenAI, Two Former Employees for Trade Secrets Theft

“Because the state was a party to the Chapter 11 case and was given a fair chance to challenge this court’s subject-matter jurisdiction, the state cannot challenge it now” by pursuing its lawsuit, Walsh wrote.

California sued four months after Walsh approved the creation of a fund to resolve most U.S. customer claims from the data breach.

On Tuesday, Walsh authorized ⁠a $32.46 million payment, on top of $14.29 million previously disbursed, for a total payout of $46.75 million.

Palo Alto, California-based 23andMe filed for protection from creditors in March 2025.

TTAM Research Institute, a nonprofit controlled by 23andMe co-founder Anne Wojcicki, ​bought 23andMe’s assets for $305 million last July.

Read more Family Demands Answers in Death of Young Black Man in Mississippi

(Reporting by Jonathan Stempel in ​New York; editing by David Gaffen)

Copyright 2026 Thomson Reuters.

Leave a Reply

Your email address will not be published. Required fields are marked *