California Barred From Seeking Damages Against 23andMe Successor in Data Breach Case

A U.S. bankruptcy judge ruled Friday that California cannot seek monetary damages from Chrome Holding Co, the successor to genetics testing firm 23andMe, in connection with a 2023 data breach. The decision deals a significant blow to the state's legal action, which sought millions in civil fines over the incident that exposed the data of an estimated 6.9 million customers.

The Court's Ruling

U.S. Bankruptcy Judge Brian Walsh in St. Louis determined that 23andMe's Chapter 11 reorganization plan precludes the state from pursuing financial penalties against the new entity. According to the court's decision, California was a party to the bankruptcy proceedings and cannot now challenge the plan's terms through a separate lawsuit.

The court has given California 14 days to either dismiss its May 28 lawsuit, filed in San Francisco Superior Court, or amend it to remove all claims for monetary relief. The judge clarified that the state could still pursue non-monetary remedies against the company.

Implications for State's Lawsuit

The ruling is a setback for California Attorney General Rob Bonta, who had accused 23andMe of ignoring warnings about its system vulnerabilities and downplaying the breach's severity. The state's lawsuit aimed to secure potentially millions of dollars in civil fines.

Ad

Judge Walsh rejected the attorney general's argument that the bankruptcy court was becoming "a haven for wrongdoers." He wrote that because the state had a fair chance to challenge the court's jurisdiction during the Chapter 11 case, it is now bound by its outcome.

Background on the Bankruptcy

Palo Alto-based 23andMe filed for Chapter 11 protection from creditors in March 2025 following extensive litigation related to the data breach. In July of that year, its assets were acquired for $305 million by TTAM Research Institute, a nonprofit controlled by 23andMe co-founder Anne Wojcicki, which now operates as Chrome Holding Co.

Separate from the state's lawsuit, the bankruptcy plan established a fund to resolve U.S. customer claims. The court has authorized total payouts of $46.75 million from this fund to compensate individuals affected by the breach.