California sues 23andMe, alleging it failed to protect user data in 2023 breach

California’s attorney general sued Chrome Holding Co. (formerly 23andMe) for failing to protect user data in a 2023 breach affecting 7 million people. The breach, using credential stuffing from a 2017 MyHeritage data leak, allowed attackers to access 14,000 accounts and steal genetic data, health reports, and relative information, which was later sold on the dark web. The lawsuit seeks penalties and injunctions against the company for violating privacy laws.