Introduction
Imagine ordering a DNA testing kit because you’re curious about your family history. So you send in a saliva sample, wait a few weeks, and receive a report about your ancestry. Maybe you discover relatives you never knew existed or learn something interesting about your genetic background.
It’s fascinating information, and it’s also incredibly personal.
Now imagine discovering that someone stole that information and offered it for sale online. What would you do?
You can change a stolen password, and you can cancel a compromised credit card, but you can’t change your DNA. That’s what makes the latest developments involving genetic testing company 23andMe so concerning.
$6M Settlement Over Stolen Genetic Data
On October 19, 2026, California’s Attorney General announced a $6 million settlement involving 23andMe’s massive 2023 data breach.
The original attack affected approximately 6.9M customers, including more than 855K Californians. According to state investigators, the attacker initially gained access to accounts using previously stolen usernames and passwords. This technique, known as credential stuffing, works when people reuse the same login information across multiple websites.
Unfortunately, the attacker didn’t stop with those accounts.
23andMe also offered a feature called DNA Relatives, which allowed customers to discover genetic connections with other users. Investigators found that the attacker exploited weaknesses in this feature to access information associated with millions of additional people. The stolen data included ancestry information, family relationships, and other sensitive personal details.
Even more concerning, California officials alleged that the attacker remained undetected for more than five months. Some of the stolen information eventually appeared for sale on the Dark Web.
The company filed for bankruptcy in March 2025, and its assets, including customer genetic information and biological samples, were subsequently sold to a nonprofit organization established by 23andMe’s co-founder. California challenged that sale, arguing that customers hadn’t explicitly agreed to the transfer of their genetic information.
The October 2026 settlement resolves the state’s claims and legal challenges, although the agreement was still awaiting court approval when announced.
Why Is Genetic Information Different?
Your genetic information can reveal information about your ancestry, biological relatives, and certain inherited health risks. More importantly, it doesn’t belong exclusively to you in the usual sense.
For example, you share genetic characteristics with your parents, siblings, children, and other biological relatives. That means information about one person can sometimes reveal details about other family members who never submitted a DNA sample themselves.
It’s a level of privacy we don’t always consider when signing up for a service like 23andMe.
What Happens When a Company Changes Owners?
Here’s another question worth asking: What happens to your personal information if the company storing it goes out of business?
You might assume the company simply deletes everything, but unfortunately, that doesn’t always happen. Businesses may sell customer databases, transfer information to new owners, or include valuable data among their assets during bankruptcy proceedings.
That’s exactly why the 23andMe situation became such a major privacy dispute. California argued that genetic information deserved special protections and that customers should have a say in whether another organization received it.
The state ultimately couldn’t prevent the asset sale, but officials emphasized that California consumers still have the right to request deletion of their genetic data and destruction of their biological samples.
How Can You Protect Your Most Sensitive Information?
You don’t need to avoid every service that collects personal information. Instead, think carefully about what you’re sharing and whether the benefits justify the risks.
Before providing sensitive information, ask yourself:
- Does this company really need this information?
- How long will it keep my data?
- Can I request deletion later?
- Will my information be shared with other organizations?
- What happens to my data if the company is sold?
Use unique passwords and multi-factor authentication whenever possible. These protections can help prevent someone from accessing your account using stolen credentials.
You should also periodically review privacy settings and delete information you no longer want a company to retain.
For genetic testing services, check whether you can request destruction of your original biological sample, as well as deletion of your digital information.
Conclusion
Remember that deleting information from a company’s systems cannot guarantee recovery of copies criminals already stole. The 23andMe breach is one stark reminder that some of our most sensitive information can remain valuable long after we share it.
Once criminals obtain certain personal details, there’s no simple way to make that information private again.
Before handing over genetic data, health information, or other sensitive details, consider how the organization plans to protect and use them. After all, you can reset your password tomorrow — but your DNA is yours for life.
