23andMe Files for Bankruptcy, DNA Data of 15 Million Customers on Sale

23andMe has filed for Chapter 11 bankruptcy protection, prompting new fears over the future of the sensitive DNA data it holds on more than 15 million customers worldwide.

The company announced on Sunday that it will pursue a court-supervised asset sale through the U.S. Bankruptcy Court for the Eastern District of Missouri. The move follows months of financial instability and leadership turmoil that started in October 2024.

More recently, the situation escalated with a rejected takeover bid by company co-founder Anne Wojcicki, who also stepped down as CEO. 23andMe has secured $35 million in debtor-in-possession (DIP) financing from JMB Capital Partners to continue operating during the restructuring while publicly stating that no immediate changes will occur to the way it stores or handles customer data.

However, the announcement has reignited deep concerns from privacy advocates and regulators, who warn that a sale could put customer DNA data in the hands of unknown buyers. In particular, customers worry about whether the genetic information they once shared for ancestry insights or health predisposition reports could now become a commoditized asset sold to the highest bidder.

23andMe, a once high-flying consumer genomics and biotechnology firm headquartered in California, has been under increasing scrutiny since a major data breach in October 2023. That incident directly compromised 14,000 accounts and led to the exposure of genetic profiles for roughly 6.9 million additional users through the company’s “DNA Relatives” feature. Despite introducing two-factor authentication and other security measures, the breach caused widespread loss of trust — a problem compounded by board resignations and mounting legal liabilities throughout 2024.

The company now seeks to resolve those liabilities as part of the bankruptcy process. According to court filings, it is also planning to reject numerous contracts, including leases for its offices in Sunnyvale and San Francisco, in an effort to reduce costs.

23andMe genetic data should be wiped

In response to the bankruptcy, regulators have begun issuing public advisories urging consumers to take immediate action to protect their data.

California Attorney General Rob Bonta released an alert reminding residents that they can request the deletion of their genetic data under the state’s Genetic Information Privacy Act (GIPA) and the California Consumer Privacy Act (CCPA). Bonta urged 23andMe customers to take proactive measures to safeguard their genetic information while the company undergoes a sale process.

The U.K.’s Information Commissioner’s Office (ICO) also confirmed it is actively monitoring the situation, having already issued a provisional enforcement notice and a proposed £4.59 million fine over the 2023 breach.

23andMe maintains that any eventual buyer will be required to adhere to all relevant privacy laws and regulations, but critics remain skeptical. A significant portion of 23andMe’s customers — about 80% — had previously consented to the use of their genetic data for medical research, often shared with partners like GlaxoSmithKline. The company has said that it remains committed to transparency, though customers worry that those data-sharing agreements may not be revisited or revocable in the event of a sale.

CyberInsider previously reported how gaps in U.S. federal law mean genetic data lacks the same protections as traditional medical records. Unlike data covered under HIPAA, consumer genetic data is regulated inconsistently across states, leaving users reliant on company policies or state-specific laws to secure their privacy. Furthermore, genetic data, once shared, is immutable — a core concern for privacy experts who argue that even anonymized data can potentially be re-identified.

Though 23andMe insists customer data remains protected, it is recommended that users take action immediately:

• Delete genetic data: Log in to your 23andMe account → Go to Settings → Scroll to 23andMe Data → Click View → Scroll to Delete Data → Click Permanently Delete Data → Confirm deletion via the email sent to your inbox.
• Destroy DNA samples: If you previously allowed 23andMe to store your saliva sample, revoke that preference under Settings → Preferences.
• Withdraw research consent: To stop 23andMe or third parties from using your data in research, adjust your permissions under Research and Product Consents in your account settings.

As the company continues through bankruptcy proceedings, customers should monitor official updates closely and consider downloading their raw genetic data before initiating deletion, should they want to retain it for future personal use.