What Happened to 23andMe? A Timeline of the Breach and Bankruptcy

23andMe got hacked in 2023. Attackers reached millions of accounts through a feature meant to connect genetic relatives. Then the company filed for bankruptcy in March 2025 and sold the genetic data of more than 15 million people to a new owner. I read the paper that number comes from, a 2025 Science piece by University of Maryland law professor Natalie Ram, and I keep coming back to it. Here's how it actually happened, in order.

The 2023 breach: one feature, millions of people

Late 2023, 23andMe disclosed that attackers had broken into a set of user accounts. Bad, but contained, or so it looked at first. Except 23andMe had built a feature called DNA Relatives, which lets users see genetic matches with other people who'd opted in. That connectivity is what turned a limited break-in into something much bigger, and it's the part of this story I think people skip past too fast.

I dug into a 2025 analysis in the Proceedings of the AAAI/ACM Conference on AI, Ethics, and Society, and it lays this out plainly: "Exploiting 23andMe's relative linkage feature hackers accessed data for an additional 5.5M users." Sit with that for a second. Those 5.5 million people hadn't reused a password. They hadn't had their own account stolen at all. They were just related, genetically, to someone who had. That's the whole mechanism.

A company regulators had already flagged

This wasn't 23andMe's first run-in with oversight. Honestly, that surprised me when I first traced the timeline back. A 2019 review in the Journal of Personalized Medicine notes that the FDA had already warned 23andMe once before, telling the company to scale back a marketing campaign promoting its genetic health risk testing services. That warning predates the breach by years. Years, not months. I think it's worth knowing anyway, because it shows a pattern: a fast-growing consumer genetics company that regulators had already had to slow down at least once, well before anything got hacked.

March 2025: bankruptcy

23andMe filed for bankruptcy in March 2025. Ten years after its FDA warning. There's a Frontiers in Genetics paper, published in 2026, that describes 23andMe as "the most famous and longstanding consumer genomics company in the world." I think that framing matters more than it first seems to. This wasn't some small startup quietly folding. It was the company that, more than any other, normalized mailing off a saliva sample and getting your ancestry and health data back in the mail.

Who ends up with your DNA after a bankruptcy sale

Here's the part that should actually worry you if you spit in a 23andMe tube at any point over the last two decades. After the bankruptcy filing, the company's assets went up for sale, and those assets included the genetic data itself. All of it. Ram says it directly in that same Science article: "After declaring bankruptcy in March 2025, direct-to-consumer (DTC) genetic testing company 23andMe sold the data of more than 15 million people."

Fifteen million people's genomes, sold off as part of a bankruptcy proceeding. Nobody stole it this time. It was sold, legally, as a company asset. Read that sentence again if you need to.

That's the uncomfortable idea the Frontiers in Genetics paper is getting at when it describes companies like 23andMe functioning as unregulated biobanks. Your genetic data isn't just information sitting quietly in a database somewhere. It's something a bankruptcy court can order transferred, the same way it would order the sale of office furniture or a customer list. Ordinary corporate law just wasn't written with a warehouse of 15 million genomes in mind. Nobody planned for this. And I don't think anyone building that law in the 1990s could have pictured it.

Why this matters if you're choosing a DNA testing company now

None of this means every DNA testing company is one bad quarter away from auctioning off your genome. Most aren't in financial trouble, and I'm not going to pretend otherwise. But 23andMe's collapse answers a question people used to treat as hypothetical: can a genetic testing company's data survive the company itself? Now there's a real case study. With a real number attached to it.

A 2023 Cureus review on the ethics of direct-to-consumer genetic testing flagged privacy and consent as recurring problems across the whole category, not something unique to one company. So no, this isn't just a 23andMe problem dressed up as a bigger one. 23andMe is just the sharpest example anyone's got so far. It probably won't be the last. I'd bet on that.

So read the privacy policy before you order a kit. I know, nobody wants to hear that. Reputable DNA testing companies typically spell out what happens to your sample and your data if the business is acquired, merges, or shuts down, but the specifics vary company to company, and some policies say a lot more than others. That goes for Biome's DNA test or whole genome test just as much as it goes for anyone else selling a kit. Check the actual document. Don't just assume.

FAQ

What happened to 23andMe's data breach in 2023? Attackers accessed a set of user accounts, then used 23andMe's relative-matching feature to reach an additional 5.5 million users who hadn't had their own accounts compromised, according to a 2025 AAAI/ACM analysis.

Did 23andMe actually go bankrupt? Yes. 23andMe filed for bankruptcy in March 2025, documented in both a 2025 Science article and a 2026 Frontiers in Genetics paper.

Who owns 23andMe's genetic data now? After the bankruptcy filing, 23andMe's genetic data, covering more than 15 million people, was sold to a new buyer as part of the proceedings, according to Ram's 2025 Science article.

Was 23andMe warned by regulators before the breach? Yes. A 2019 review notes the FDA had already told 23andMe to scale back marketing of its genetic health risk testing services, years before the 2023 breach and 2025 bankruptcy.

Should this change how I pick a DNA testing company? It's a good reason to actually read a company's privacy policy before testing, specifically the part covering what happens to your data if the company is sold, acquired, or shut down, rather than assuming every provider handles that the same way.