Key facts
- A U.S. bankruptcy judge ruled California cannot seek damages from Chrome Holding Co, the successor to 23andMe, regarding a 2023 data breach.
- The judge cited 23andMe's Chapter 11 reorganization plan as precluding the state from monetary relief.
- California's Attorney General Rob Bonta had accused 23andMe of ignoring warnings and downplaying the breach's severity.
- The state must dismiss its lawsuit or amend it to remove monetary claims within 14 days.
- A total of $46.75 million has been authorized for payouts to customers affected by the breach.
A U.S. bankruptcy judge has ruled that California cannot pursue damages from the successor company of 23andMe in relation to a 2023 data breach. U.S. Bankruptcy Judge Brian Walsh stated that the company's Chapter 11 reorganization plan prevents the state from seeking monetary relief against Chrome Holding Co and its affiliate.
Judge Walsh ordered California to either dismiss its lawsuit, filed in San Francisco Superior Court, within 14 days or amend its complaint to remove claims for monetary damages. This decision represents a setback for California Attorney General Rob Bonta, who had accused 23andMe of ignoring warnings about its compromised systems and downplaying the severity of the breach, while seeking potentially millions of dollars in civil fines.
The Attorney General's office had argued that bankruptcy judges do not have the authority to prohibit state law-based enforcement actions in state courts, suggesting bankruptcy courts could become "a haven for wrongdoers." However, Judge Walsh disagreed, stating that the reorganization plan did not create such a haven and that California, as a party to the Chapter 11 case with a fair opportunity to challenge jurisdiction, could not now challenge it through its lawsuit.
California's lawsuit was filed four months after Judge Walsh approved the creation of a fund to resolve most U.S. customer claims stemming from the data breach. The court has since authorized a total payout of $46.75 million for affected customers, with $32.46 million recently approved on top of $14.29 million previously disbursed. 23andMe, based in Palo Alto, California, filed for creditor protection in March 2025. Its assets were acquired last July by TTAM Research Institute, a nonprofit controlled by 23andMe co-founder Anne Wojcicki, for $305 million.