California Barred From Seeking Damages From 23andMe Successor Over 2023 Data Breach

A U.S. bankruptcy judge has blocked the state of California from seeking monetary damages from the successor company to 23andMe related to a 2023 data breach that exposed the personal information of approximately 6.9 million customers. The ruling sides with the company's argument that its Chapter 11 reorganization plan shields it from such claims.

The Court's Ruling

U.S. Bankruptcy Judge Brian Walsh in St. Louis determined that 23andMe's court-approved bankruptcy plan precludes California from pursuing monetary relief against the successor entity, Chrome Holding Co. According to the decision reported by Reuters, the state can still seek non-monetary remedies.

Judge Walsh gave California 14 days to either dismiss its May 28 lawsuit, filed in San Francisco Superior Court, or amend it to remove all claims for financial damages. The judge noted that because California was a party to the Chapter 11 case, it cannot now challenge the court's jurisdiction through a separate state-level lawsuit.

Setback for California's Lawsuit

The decision is a defeat for California Attorney General Rob Bonta, who had accused 23andMe of failing to act on warnings about its system vulnerabilities and downplaying the severity of the breach. The state's lawsuit was seeking potentially millions of dollars in civil penalties.

Ad

Bonta's office had argued that bankruptcy courts should not become a "haven for wrongdoers" by prohibiting state law enforcement actions. However, Judge Walsh disagreed that the reorganization plan created such a haven in this instance, according to the court filing.

Bankruptcy and Restructuring Context

The genetic testing firm, then based in Palo Alto, filed for Chapter 11 bankruptcy protection in March 2025. The company's assets were subsequently purchased for $305 million in July 2025 by TTAM Research Institute, a nonprofit controlled by 23andMe co-founder Anne Wojcicki.

As part of the bankruptcy proceedings, the court previously approved the creation of a fund to resolve customer claims from the data breach. The total payout authorized for that fund now stands at $46.75 million, following an initial disbursement of $14.29 million and a more recent authorization for $32.46 million.