Story
Court Blocks California's Bid for Damages From 23andMe Successor Over 2023 Breach
Summary
A U.S. bankruptcy judge has ruled that California cannot pursue monetary damages against Chrome Holding Co., the successor to 23andMe, in connection with the 2023 data breach, citing protections under the company's Chapter 11 reorganization plan.
A U.S. bankruptcy judge has blocked the state of California from seeking monetary damages from the successor to genetic testing firm 23andMe over a 2023 data breach that compromised the information of millions. The ruling hinges on the protections granted to the company under its approved Chapter 11 reorganization plan.
The Court's Ruling
U.S. Bankruptcy Judge Brian Walsh in St. Louis determined that 23andMe's court-approved bankruptcy plan precludes California from pursuing financial penalties against the successor entity, Chrome Holding Co. According to the decision, the state may still seek non-monetary remedies.
Judge Walsh has given California 14 days to either dismiss its May 28 lawsuit or amend its complaint to remove all claims for monetary relief. The judge stated that because California was a party to the Chapter 11 proceedings, it had a fair opportunity to challenge the court's jurisdiction at that time and cannot do so now through a separate lawsuit.
A Defeat for the Attorney General
The decision represents a significant setback for California Attorney General Rob Bonta, who had accused 23andMe of failing to act on warnings about its system vulnerabilities and downplaying the scale of the breach. The state's lawsuit sought potentially millions of dollars in civil fines.
AdThe attorney general's office had argued that bankruptcy courts should not become a "haven for wrongdoers" by prohibiting state law enforcement actions. However, Judge Walsh disagreed that the reorganization plan created such a haven and affirmed the finality of the Chapter 11 confirmation order.
Breach and Bankruptcy Background
The legal battle stems from a 2023 data security incident that exposed the genetic and personal information of an estimated 6.9 million 23andMe customers.
Key developments following the breach include:
- Palo Alto-based 23andMe filed for Chapter 11 bankruptcy protection in March 2025.
- The company's assets were acquired by TTAM Research Institute, a nonprofit controlled by co-founder Anne Wojcicki, for $305 million in July of last year.
- A separate fund to resolve most U.S. customer claims was established, with the court authorizing total payouts of $46.75 million.