23andMe Shows Why Genetic Data Is Not Just Another Bankruptcy Asset
California’s lawsuit against the successor to 23andMe is not just another data-breach story. It is a warning about what happens when the most intimate consumer data in America gets treated like an ordinary startup asset.
The current peg is straightforward. BBC reported that California Attorney General Rob Bonta said he will sue Chrome Holding, the successor to 23andMe, after an investigation into the company’s 2023 breach. Bonta alleges that 23andMe failed to take basic steps to protect sensitive customer data and misled consumers about the severity of the incident. The breach reportedly exposed genetic predispositions and risk factors, information about biological relatives, ancestry, and ethnicity for nearly seven million users.
That is already serious. But the deeper issue is not simply that hackers got into accounts. It is that the American consumer-data model was never built for information that cannot be meaningfully changed, rotated, or forgotten.
If a credit-card number leaks, the bank can cancel the card. If a password leaks, a user can reset it. If an email address leaks, a person can move accounts, however painfully. Genetic data is different. Your genome is not a password. Your ancestry is not a login credential. Your biological relatives are not a preference setting. When that data escapes, the exposure is durable, relational, and in some cases inherited by people who never agreed to the transaction in the first place.
That is why the 23andMe story belongs in the same category as infrastructure failure, not ordinary app negligence. The company did not merely hold customer profiles. It held a map of biological identity, family connection, disease-risk information, and ancestry signals. The public was sold a product that felt personal, fun, and consumer-friendly. The institutional reality was much heavier: a private company accumulated a sensitive database that regulators, insurers, employers, law enforcement, marketers, hackers, and future buyers would all have reason to care about.
The lawsuit also lands after 23andMe’s business model already cracked. BBC noted that the company was rebranded after filing for bankruptcy last year. That timing matters. Bankruptcy is supposed to be a process for sorting claims, assets, liabilities, and creditor rights. It works tolerably well when the assets are buildings, contracts, equipment, or accounts receivable. It becomes far more troubling when the asset is a database of human biological information.
This is the part Washington and Sacramento need to take seriously. A consumer biotech company can fail like any other company. Its servers do not become less sensitive because its stock price collapsed. Its duties do not disappear because investors lost money. If anything, the moment of financial distress is exactly when the public needs stronger guardrails, because distressed assets get sold, merged, renamed, packaged, and monetized under pressure.
The public-trust problem is not abstract. Bonta alleged that data offered on the dark web specifically touted Asian American Pacific Islander and Jewish users. That detail changes the moral weight of the breach. It means the harm is not limited to identity theft in the narrow financial sense. Biological and ancestry data can become a targeting tool. It can turn a consumer genealogy product into a map of vulnerable communities.
That does not require panic or science-fiction rhetoric. It requires institutional seriousness. Genetic data is not dangerous because every use is sinister. It is dangerous because the downside is asymmetric. The consumer gets a fun ancestry report, a health-risk estimate, or a family-match feature. The company gets a monetizable data asset. The public gets a new category of long-lived exposure that existing privacy law still treats too much like ordinary account information.
This is where the usual tech-sector defense falls short. Companies often respond to breaches by pointing to user behavior: reused passwords, credential stuffing, phishing, or weak personal security. Those details can be true and still incomplete. According to BBC, users were targeted through a credential-stuffing attack, where hackers used passwords exposed in previous breaches to access 23andMe accounts. But a company holding unusually sensitive data cannot design its controls around the fantasy that ordinary consumers will maintain perfect password hygiene forever.
That is the implementation failure. Institutions like to sell convenience and then blame individuals when convenience collides with reality. If a platform knows it holds data that cannot be replaced, then authentication, monitoring, breach notification, deletion rights, and transfer restrictions should be built for that risk from the beginning. The standard should not be, “Did the user reuse a password?” The standard should be, “Did the institution design the system as if the data was biologically permanent?”
The United Kingdom’s Information Commissioner’s Office already moved in this direction. BBC reported that the ICO fined 23andMe £2.31 million and said the company failed to put adequate measures in place to secure sensitive user data before the incident. The ICO also noted that genetic data receives special protection under UK law because of its sensitivity. That is the right frame. Genetic data deserves a higher institutional duty because the consequences of exposure are not confined to one account holder at one moment in time.
The American system remains too fragmented. We have sector-specific health privacy rules, state privacy laws, breach-notification statutes, consumer-protection enforcement, and bankruptcy courts. But consumer genetic platforms sit awkwardly across all of them. They are health-adjacent, but not always treated like hospitals. They are consumer-tech companies, but their data is more intimate than most consumer-tech data. They are research platforms, ancestry platforms, family-matching platforms, and potential acquisition targets all at once.
That ambiguity is profitable until something breaks.
The lesson from 23andMe is that public trust has a balance sheet. Companies can borrow against it for years. They can make the product feel harmless. They can make consent feel like a checkbox. They can make data collection feel like entertainment. But once the breach happens, the public discovers that trust was not a slogan. It was an unfunded liability.
There are three policy questions that should come out of this case.
First, should genetic-data companies be allowed to transfer sensitive customer databases through bankruptcy or acquisition without stronger affirmative consent from users? A normal asset sale is not good enough when the asset is biological identity. If the company changes hands, users should not have to hope that a new owner shares the same duties, incentives, and promises as the old one.
Second, should deletion rights be stronger and simpler before a company enters financial distress? BBC noted that 23andMe came under scrutiny last year when users reported difficulty deleting accounts after the company filed for Chapter 11 protection. That is exactly backwards. The more fragile the company becomes, the easier it should be for users to withdraw data from the system.
Third, should genetic-data security be regulated as a special category of consumer infrastructure rather than as ordinary privacy compliance? The answer should be yes. This does not require banning consumer DNA services. It requires admitting that the data is different and that different data needs different duties.
A serious framework would include stronger default multi-factor authentication, strict limits on secondary use, clear breach-notification rules, plain-language deletion rights, restrictions on sale or transfer after bankruptcy, independent security audits, and personal accountability for executives who minimize or misrepresent breach severity. None of that is radical. It is basic institutional hygiene for companies asking people to hand over information that outlives them.
There is also a cultural lesson here. The consumer internet trained people to think of data as a price paid for convenience. Genetic testing stretched that bargain to its limit. It converted identity, ancestry, health probability, and family connection into a consumer product. The pitch was discovery. The risk was dependency on institutions that may not survive, may be sold, may be breached, or may have incentives that change after the data is already collected.
The point is not that everyone who used 23andMe made a foolish choice. People were responding to a product sold through trust, curiosity, and the promise of personal knowledge. The responsibility sits higher up the chain. Companies that build business models around intimate data should be held to duties that match the intimacy of what they collect.
That is why this case should not be buried as one more breach in the endless pile of breach stories. It is a test of whether regulators understand the difference between data that is inconvenient to lose and data that is impossible to replace.
The old privacy model assumes harm can be contained after the fact. Freeze the credit. Reset the password. Notify the user. Offer monitoring. Move on. Genetic data does not fit that script. It is permanent. It is shared with relatives. It can reveal group identity. It can be copied forever. And when a company collapses, the database does not collapse with it.
23andMe showed Americans the appealing side of consumer genetics. The California lawsuit is showing the other side: when biological identity becomes a venture-backed database, bankruptcy is not the end of the story. It may be the moment the public finally sees what the asset really was.