23andMe

23andMe, a consumer genetic testing company founded in 2006, filed for Chapter 11 bankruptcy protection on March 23, 2025.¹³⁸¹⁶ The company faced a major data breach in 2023 that compromised the personal information of nearly 7 million customers.^10111516 In June 2025, 23andMe's assets were sold to TTAM Research Institute for $305 million through the bankruptcy process.³⁸¹¹

Timeline

Money raised

23andMe raised $8.95 million in Series A funding on May 22, 2007, from investors including Genentech, Google Ventures, Mohr Davidow Ventures, and New Enterprise Associates.³ 23andMe raised $27.78 million in Series B funding on December 23, 2009, from investors including Google Ventures and New Enterprise Associates.³ 23andMe raised $31.18 million in Series C funding on November 10, 2010, from investors including Google Ventures, Johnson & Johnson, MPM Capital, New Enterprise Associates, and Roche Venture Fund.³ 23andMe raised $58.45 million in Series D funding on December 10, 2012, from investors including Google Ventures, MPM Capital, and New Enterprise Associates.³ 23andMe raised $115.25 million in Series E funding on June 8, 2015, from investors including Casdin Capital, Fidelity Management, Google Ventures, Illumina Ventures, MPM Capital, New Enterprise Associates, Wuxi Venture Fund, and Xfund.³ 23andMe raised $250 million in Series F funding on September 12, 2017, from investors including Altimeter Capital Management, Casdin Capital, Euclidean Capital, Fidelity Management, Sequoia Capital, and Wallenberg Foundation.³ 23andMe raised $385 million in Series F-1 funding on December 23, 2020, from investors including GlaxoSmithKline, NewView Capital, and Sequoia Capital.³ 23andMe has raised $876.61 million in total funding to date.³ 23andMe went public in June 2021 via a merger with a special purpose acquisition company, which valued the company at around $3.5 billion at the time.¹⁶ In the bankruptcy sale, TTAM Research Institute acquired 23andMe's assets for $305 million.³¹¹

Investors named in the sources: Altimeter Capital Management³, Casdin Capital³, Euclidean Capital³, Fidelity Management³, Genentech³, GlaxoSmithKline³, Google Ventures³, Illumina Ventures³, Johnson & Johnson³, Mohr Davidow Ventures³, MPM Capital³, New Enterprise Associates³, NewView Capital³, Roche Venture Fund³, Sequoia Capital³, Wallenberg Foundation³, Wuxi Venture Fund³.

What happened

23andMe was founded in April 2006 by Linda Avey, Paul Cusenza, and Anne Wojcicki.³ The company provided at-home, consumer genetic testing and was the first FDA-approved direct-to-consumer genetic sequencing supplier.³ 23andMe leveraged its genetic database in pursuit of pharmaceutical drug development.³ In 2013, the Food and Drug Administration ordered the company to cease sales of its personal genomics test.⁶ In April 2017, the FDA gave 23andMe approval to provide customers with a risk analysis for 10 genetically linked diseases.⁶

23andMe went public in June 2021 via a merger with a special purpose acquisition company, which valued the company at around $3.5 billion at the time.¹⁶ The company struggled to generate recurring revenue and stand up viable research and therapeutics businesses.¹⁶ On August 11, 2023, a cybercriminal posted to an online forum advertising a stolen data set of personal information belonging to 23andMe users.¹⁰ In early October 2023, 23andMe user data appeared for sale on a second cybercrime forum.¹⁰ On October 6, 2023, 23andMe confirmed that it had suffered a major data breach.¹⁵

The data breach compromised the personal information of nearly 7 million users.¹⁰¹⁵¹⁶ The compromised data contained names, genders, dates of birth, ancestors' birth locations and family names, family tree information, profile pictures, geographic locations, and genetic information such as maternal and paternal haplogroup results and predicted relationships with genetic matches.¹⁰ The threat actor used a well-known type of cyberattack called credential stuffing.¹⁵ The threat actor accessed about 14,000 customers' 23andMe accounts directly.¹⁵ The threat actor leveraged a vulnerability involving a critical coding error in the DNA Relatives feature to steal additional identifying information, ancestry reports, and reports indicating the percentage of DNA shared with potential relatives about nearly 7 million consumers.¹⁵

News of the breach came to light after the data of one million consumers were offered for sale on the dark web, specifically touting that the data belonged to Asian American and Pacific Islanders and Jewish users.¹⁵ 23andMe's post-breach statements to consumers were misleading and omitted or misrepresented critical information regarding the breach.¹⁵ 23andMe was simultaneously negotiating and paying a ransom to the threat actor in exchange for the threat actor removing damaging information regarding the breach that had been posted online and providing information about multiple 23andMe security vulnerabilities.¹⁵ A 2023 investigation by the California Department of Justice and a multistate coalition found that 23andMe's pre-breach data security procedures and practices fell below security and industry standards.¹⁵ 23andMe failed to implement reasonable security procedures to prevent and detect the well-known risk of credential stuffing.¹⁵

23andMe missed several opportunities to detect the credential stuffing attack.¹⁵ 23andMe failed to guard against the exploitation of a coding error in the DNA Relatives feature.¹⁵ 23andMe failed to properly account for genetic data, its nature, and its high-level of sensitivity when drafting and implementing its data security protocols.¹⁵ On March 23, 2025, 23andMe and affiliated entities filed for Chapter 11 bankruptcy in the United States Bankruptcy Court for the Eastern District of Missouri.⁸⁹¹⁶ The company's CEO, Anne Wojcicki, resigned from her role as chief executive effective immediately, though she remained a member of the board.¹⁶

Joseph Selsavage, 23andMe's chief financial and accounting officer, served as interim CEO.¹⁶ 23andMe had between $100 million and $500 million in estimated assets, as well as between $100 million and $500 million in estimated liabilities, according to the bankruptcy filing.¹⁶ 23andMe used the Chapter 11 proceedings to facilitate a sale process to maximize the value of its business.⁸ On March 24, 2025, the Debtors filed a motion seeking to approve bidding procedures for a sale of substantially all of their assets.⁸ On March 28, 2025, the Bankruptcy Court entered an order approving bidding and auction procedures.⁸

Commencing on May 14, 2025, the Debtors conducted an auction with respect to the assets.⁸ At the conclusion of the bidding process, the Debtors selected TTAM Research Institute as the Successful Bidder and Regeneron Pharmaceuticals, Inc. as the Backup Bidder.⁸ The Bankruptcy Court entered an order approving entry into the sale transaction with TTAM Research Institute on June 27, 2025.⁸ 23andMe completed their merger and acquisition with TTAM Research Institute for $305 million on June 30, 2025.³ TTAM Research Institute was an entity operated by 23andMe's co-founder, Anne Wojcicki.¹¹

On September 4, 2025, Plaintiffs and Debtors filed a joint motion for preliminary approval of a proposed class action settlement to resolve all claims asserted in the data breach litigation.¹⁰ On October 2, 2025, U.S. Bankruptcy Judge Brian C. Walsh issued an Order granting preliminary approval of the proposed settlement.¹⁰ On January 30, 2026, Judge Walsh issued an Order granting final approval of the settlement.¹⁰ On July 7, 2026, a California bankruptcy court judge ruled that Chrome Holding should pay out $46.75 million in compensation to data breach victims.¹¹ The settlement will be first paid to Kroll Restructuring, which is representing the victims, within five business days from the ruling.¹¹

Kroll will then distribute the funds to the victims.¹¹ The company has continued to operate since the bankruptcy, offering DNA testing kits to people online.¹¹ Customers still had the ability to delete their data and 23andMe account during the bankruptcy process.⁹ The Missouri Attorney General sought the appointment of an independent consumer protection ombudsman, and the bankruptcy court granted the request.⁹ Privacy expert Professor Neil Richards was selected as the ombudsman to evaluate whether the company could legally sell its customers' data.⁹

Legal outcomes

• filedA class action lawsuit was filed against 23andMe over the 2023 data breach.⁷¹⁰
• filedOn April 11, 2024, the data breach actions were consolidated in the United States District Court for the Northern District of California.¹⁰
• filedPlaintiffs filed a Consolidated Class Action Complaint on June 26, 2024.¹⁰
• filedOn September 4, 2025, Plaintiffs and Debtors filed a joint motion for preliminary approval of a proposed class action settlement.¹⁰
• settledOn October 2, 2025, U.S. Bankruptcy Judge Brian C. Walsh granted preliminary approval of the proposed settlement.¹⁰
• settledOn January 30, 2026, Judge Walsh granted final approval of the settlement.¹⁰
• settledOn July 7, 2026, a California bankruptcy court judge ruled that Chrome Holding should pay out $46.75 million in compensation to data breach victims.¹¹
• filedCalifornia Attorney General Rob Bonta filed a lawsuit against Chrome Holding Co., formerly known as 23andMe, for failing to protect customers' sensitive personal information and genetic data.¹⁵
• filedThe lawsuit alleges that 23andMe failed to implement and maintain reasonable security procedures and made misleading statements regarding its security and the data breach.¹⁵
• filedA Canadian class action was filed against 23andMe Holding Co. and 23andMe, Inc. over the data breach.¹⁴
• settledOn February 17, 2026, the United States Bankruptcy Court approved the Canadian Data Breach Settlement on a final basis.¹⁴
• settledOn March 16, 2026, the Supreme Court of British Columbia recognized the orders of the United States Bankruptcy Court.¹⁴

Where the founders are now

Anne Wojcicki resigned as CEO of 23andMe effective March 24, 2025, but remained a member of the board.¹⁶ Anne Wojcicki planned to pursue the company as an independent bidder in the bankruptcy sale.¹⁶ TTAM Research Institute, an entity operated by Anne Wojcicki, won the bankruptcy auction with a bid of $305 million.¹¹ Linda Avey and Paul Cusenza co-founded 23andMe with Anne Wojcicki in 2006.³

Sources

1. 23andMe Bankruptcy Filing—What 15 Million Users ... - Forbes, forbes.com, Mar 25, 20
3. 23andMe IPO Timeline and Financing Details - Forge, forgeglobal.com
6. 23andMe hits $1.5B pre-money valuation in latest huge funding round | TechCrunch, TechCrunch, 2017-09-06
7. 23andMe Data Settlement, 23andmedatasettlement.com
8. Kroll Restructuring Administration, restructuring.ra.kroll.com
9. Attorney General Bailey Issues Consumer Alert Regarding 23andMe Bankruptcy | Attorney General Office of Missouri, ago.mo.gov
10. 23andMe Data Breach | Keller Rohrback, kellerrohrback.com
11. Victims of 23andMe data breach to get $47m payout, judge rules, bbc.com, Jul 7, 202
14. 23andMe Canadian Data Breach Class Action - KND Complex Litigation, KND Complex Litigation, 2025-05-29
15. Attorney General Bonta Sues Chrome Holding Co., Formerly Known as 23andMe, Over 2023 Data Breach, State of California - Department of Justice - Office of the Attorney General, 2026-05-28
16. 23andMe files for bankruptcy; Anne Wojcicki steps down as CEO, NBC News, 2025-03-24

How this case file was put together

Every statement on this page carries a numbered note, and every note points to a court record, a regulatory filing or a named publication in the list of sources. Each statement was checked against the text of the sources it cites before it was published: a figure, a date or a name the cited source does not contain was cut rather than kept. Allegations are shown as allegations, with their status at the time of the source (filed, charged, convicted, pleaded, settled, dismissed or pending). Quoted lessons are the words of the person or publication named with them, copied from the cited source; nothing here is our own opinion of why the company failed.

If a fact on this page is wrong, use "Report an error" below and attach the record that shows the correct fact. Every report is reviewed by a person before anything changes, and a corrected page says when it was last corrected.

All case files2025genetic testing