Public concern over how personal DNA can be used or sold has only grown, especially as genetic data remains difficult to fully delete or control.<\/p>\n
Popular ancestry service with health promises, research ambitions<\/p>\n
Founded in 2006, 23andMe allowed users to send in saliva kits and receive reports on ancestry breakdown, DNA relatives, and health traits.<\/p>\n
The company gained worldwide popularity for its user-friendly kits and the promise of personal genetic insight.<\/p>\n
By 2021, 23andMe had gone public with a $6 billion valuation and counted over 15 million users, with 80% of them agreeing to let their genetic data be used for research. High-profile figures, including Oprah Winfrey and Snoop Dogg, publicly endorsed the service.<\/p>\n
But as the company expanded from ancestry into health-risk predictions and drug development, criticism mounted.<\/p>\n
In 2013, the U.S. Food and Drug Administration (FDA) forced 23andMe to stop offering medical risk assessments, citing concerns about accuracy and misleading claims. After a four-year suspension, the firm regained limited approval to share risk data for 10 conditions, eventually expanding the list to 50.<\/p>\n
Experts warned the medical reports could give false reassurance or cause unnecessary panic. \u201cTheir product was always very limited in what it could tell you about tendencies to disease,\u201d Anneke Lucassen, a clinical geneticist at the University of Oxford told Nature<\/a>.<\/p>\n 23andMe data breach exposed genetic info of 6.9M users<\/p>\n In October 2023, 23andMe confirmed a large-scale security breach after hackers accessed personal and genetic data through reused passwords, a method known as \u201ccredential stuffing.\u201d<\/p>\n What was exposed:<\/p>\n About 14,000 accounts were directly breachedDue to a feature called \u201cDNA Relatives,\u201d data from 6.9 million users was indirectly exposedData included names, birth years, locations, family tree links, genetic ancestry, and health traitsCurated lists were created for Ashkenazi Jewish and Chinese users and offered for sale onlineHackers sold files for as little as $1\u2013$10 per account<\/p>\n The company initially blamed users for not updating their passwords. A statement<\/a> to regulators said: \u201cThe incident was not a result of 23andMe\u2019s failure to maintain reasonable security measures.\u201d<\/p>\n The backlash was immediate. Eli Wade-Scott, an attorney representing victims, said the monthslong breach showed \u201ca total failure to monitor systems that handle highly sensitive data.\u201d<\/p>\n In June 2025, the U.K.\u2019s Information Commissioner\u2019s Office fined 23andMe<\/a> over $3 million for poor security practices and slow breach response. Canadian authorities joined the investigation.<\/p>\n Regulators concluded that 23andMe had ignored repeated warnings, failed to implement two-factor authentication, and lacked adequate breach protocols.<\/p>\n Layoffs, lawsuits, board resignations mark 23andMe\u2019s decline<\/p>\n By late 2023, 23andMe had begun cutting staff and shutting down its drug development pipeline. In November, the company laid off 40% of its workforce and halted all ongoing clinical trials.<\/p>\n A month earlier, all independent board members had resigned. In a public letter, they criticized CEO Anne Wojcicki for failing to present a \u201cfully financed, actionable proposal\u201d to take the company private. Her offer of $0.40 per share was rejected.<\/p>\n The company\u2019s valuation collapsed, with the share price falling to as low as $0.30, and its cash reserves were rapidly depleting after the board members’ resignations. In March 2025, 23andMe filed for Chapter 11 bankruptcy protection.<\/p>\n Lawsuits followed across multiple states:<\/p>\n Plaintiffs accused the company of negligence and invasion of privacyMany Jewish and Chinese users were not informed that they had been targetedSeveral lawsuits alleged 23andMe had \u201clied about the scope and severity of the breach\u201dAttorneys general from New York, California, and other ostates pened investigations into security practices<\/p>\n Lawyers said curated ethnic datasets could be exploited by state actors or extremist groups.<\/p>\n \u201cThis is a total paradigm shift when it comes to the implications of a data breach,\u201d said attorney Jay Edelson. “You have extremist groups calling for the death of Jews throughout the world, so it\u2019s hard to see how the stakes could be higher,\u201d he added.<\/p>\n Regeneron tried to buy 23andMe, but public pressure blocked sale<\/p>\n In May 2025, Regeneron Pharmaceuticals won an auction to acquire 23andMe for $256 million. The announcement sparked concern from privacy experts and regulators.<\/p>\n Attorneys general from more than 20 U.S. states sued to block the deal, arguing that DNA data should not be treated like typical corporate assets during bankruptcy.<\/p>\n \u201cI think historically there is a concern amongst the Jewish community for people knowing who we are, where we live, and our genealogy,\u201d said Kyle, a former customer who spoke to NPR<\/a>. \u201cIf that information gets into the wrong hands, it\u2019s very dangerous.\u201d<\/p>\n Public advocacy groups urged customers to delete their genetic data from 23andMe\u2019s database. The company had said it would abide by existing privacy policies, but those terms included language allowing the sale or transfer of personal data in case of bankruptcy or acquisition.<\/p>\n Former CEO buys back 23andMe through nonprofit<\/p>\n In June 2025, Anne Wojcicki returned with a competing bid through a nonprofit entity she created called TTAM Research Institute.<\/p>\n With $305 million in backing, she outbid Regeneron and regained control of 23andMe.<\/p>\n What the nonprofit promised:<\/p>\n Uphold the original privacy policy and consent structureAllow users to delete their data and biological samples at willContinue using data for medical research, but notfor commercial purposesComply with data protection laws and introduce additional oversight<\/p>\n A U.S. bankruptcy judge approved the sale, calling it a better outcome than transferring the database to a pharmaceutical firm. However, five states\u2014including California, Kentucky, and Utah\u2014remained opposed.<\/p>\n While TTAM now controls the company, not all privacy experts are reassured. \u201cOnce genetic data is incorporated into research or shared externally, there\u2019s no meaningful way to retrieve or erase it,\u201d said<\/a> Boston College Law Asst. Professor Shelly Simana<\/a>.<\/p>\n Can 23andMe users delete all data as urged?<\/p>\n After the bankruptcy filing, officials in New York and California encouraged users to delete their accounts.<\/p>\n But data experts warned that deleting a profile does not mean all DNA data disappears.<\/p>\n How to delete your data from 23andMe:<\/p>\n Log in to your accountGo to \u201cSettings\u201dClick \u201c23andMe Data\u201d \u2192 \u201cView\u201dSelect \u201cPermanently Delete Data\u201dSubmit a request to destroy any biological samples<\/p>\n Even after deletion, data previously shared in anonymized form or used in research studies is not fully recoverable. The U.S. lacks federal data privacy laws specific to consumer DNA. Companies like 23andMe are not regulated under HIPAA, the law governing medical data.<\/p>\n “My hope is that the issues that this case raises and the attention that it’s gotten will, in tur,n spur some meaningful thought about data privacy protections, and those protections in a bankruptcy,” said Laura Coordes, a bankruptcy law expert at Arizona State University.<\/p>\n
![](\"https:\/\/www.turkiyetoday.com\/s\/i\/i-share.svg\"\/)
<\/p>\n