On Oct. 19, California Attorney General Rob Bonta announced a $6 million settlement with Chrome Holding Co., the company formerly known as San Francisco-founded 23andMe. The settlement was filed in U.S. Bankruptcy Court in Missouri and still needs court approval. It resolves the state's claims that the company failed to protect customers' personal and genetic data in a 2023 breach. It also settles the state's appeal over the sale of Californians' genetic data in the bankruptcy without their consent.

How it adds up to $70 million

SFist, citing the San Francisco Business Times, puts California's deal at $6.01 million. That's on top of a $46.75 million class-action settlement finalized in July 2026 and a separate $18 million agreement with attorneys general from 42 states, for a total of more than $70 million.

What happened

The AG's office says the breach affected nearly 7 million customers nationwide, including more than 855,000 Californians. Hackers used passwords stolen in other breaches to get into accounts. Through the DNA Relatives feature, they reached information on about 5.5 million people, and Family Tree data for another 1.4 million, SFist reported. 23andMe filed for bankruptcy in March 2025, and its assets were sold to TTAM Research Institute, a nonprofit set up by co-founder Anne Wojcicki.

How to delete your 23andMe data

Bonta's office reminded Californians they can still delete their data no matter who owns the company. Its steps:

  1. Log in to your account on the 23andMe website.
  2. Go to the "Settings" section of your profile.
  3. Scroll to "23andMe Data" and click "View."
  4. If you want a copy, download your data first.
  5. Scroll to "Delete Data" and click "Permanently Delete Data."
  6. Confirm through the link in the email 23andMe sends you.

To have your stored saliva sample destroyed, change the setting under "Preferences." To withdraw consent for research use, change it in your account settings, according to the AG.