AG's Office says consumers have options after company's data breach

23and me headquarters in South San Francisco (Courtesy photo)

CONCORD - The Attorney General's office is alerting consumers that on Sunday 23andMe filed for bankruptcy protection in the Eastern District of Missouri. 23andMe is a direct-to-consumer genetic testing company that collects and analyzes individuals' genetic data.

The Office of the Attorney General has been monitoring 23andMe as part of a multistate investigation into a data breach discovered in October 2023 that led to the exposure of the personal information of nearly seven million Americans.

"23andMe collected sensitive genetic data from millions of Americans, yet failed to safeguard that information, exposing consumers to significant harm," Attorney General Formella said. "This negligence not only damaged the company's reputation but also violated the trust of those who entrusted their personal data to the company."

In a press release, 23andMe stated it intends to use the court proceeding to sell the assets of the company, which further stated, "The company intends to continue operating its business in the ordinary course throughout the sale process. There are no changes to the way the company stores, manages, or protects customer data..." Further information and updates about the bankruptcy case can be found at https://restructuring.ra.kroll.com/23andMe/#background.

Attorney General Formella would like to remind New Hampshire residents of their rights under the New Hampshire Data Privacy Act (NHDPA). New Hampshire consumers have the right to access, obtain, correct, and delete personal data collected about them. Additionally, consumers have the right to opt out of the processing of their personal data for the purposes of targeted advertising, the sale of personal data, and certain types of profiling.

"Despite the bankruptcy filing, both 23andMe and any potential buyer remain responsible for protecting consumer data," Formella stated. "Additionally, consumers can proactively protect their data by deleting their genetic data, requesting the destruction of their test sample, and revoking authorization for 23andMe to share their data with third-party researchers."

Consumers can delete their genetic data, request destruction of their test sample, and revoke permission for their data to be used for research through their 23andMe "Account Settings" page. 23andMe's privacy notice can be found at this link: https://www.23andme.com/legal/privacy/. Consumers who need assistance may contact the New Hampshire Department of Justice, Consumer Protection and Antitrust Bureau at DOJ-CPB@doj.nh.gov or 1-888-468-4454.