Rob Bonta (Attorney General of California) sent this email to me:
California is filing a lawsuit against Chrome Holding Co. — formerly known as 23andMe — for violating multiple state laws and utterly failing consumers in a dangerous and deeply disturbing way.
In 2023, after years of collecting sensitive, private information from millions of people — including mine, by the way, and perhaps yours, too — 23andMe’s failure to implement basic security measures led to a catastrophic data breach. Then they lied about it.
We’re talking about personal information like genetic risk factors, biological relatives, ancestry, and ethnicity.
News of the breach first came to light after the data of one million consumers was offered for sale on the dark web, specifically advertised as belonging to Asian American and Pacific Islander and Jewish users. This happened during a period of rising anti-AAPI and antisemitic hate and violence, making an already horrifying breach even more disturbing.
Your data belongs to you, and only you, not to a company and certainly not to a bad actor who stole or illegally bought it on the dark web.
The 2023 data breach affected nearly 7 million customers across the country, including more than 800,000 Californians.
23andMe knew their customers’ data was at risk. Not only were their security measures woefully deficient, they repeatedly misled consumers about the security of their products to induce more people to use their services!
In the aftermath of the breach, the company was simultaneously engaging in ransom negotiations with the threat actor while actively misleading consumers and downplaying the severity of the breach. They then agreed to the ransom demands and paid $400,000 in cryptocurrency for the threat actor to destroy the stolen data.
They tried to hide both the severity of the breach and their own responsibility for it. They violated a state data security law, consumer privacy law, and false advertising law, among others.
Consumers deserve accountability, and with yesterday’s lawsuit, we’re asking the court to deliver it.