DNA of 15 Million People For Sale In 23andMe Bankruptcy (404media.co) 51
An anonymous reader quotes a report from 404 Media: 23andMe filed for Chapter 11 bankruptcy Sunday, leaving the fate of millions of people's genetic information up in the air as the company deals with the legal and financial fallout of not properly protecting that genetic information in the first place. The filing shows how dangerous it is to provide your DNA directly to a large, for-profit commercial genetic database; 23andMe is now looking for a buyer to pull it out of bankruptcy. 23andMe said in court documents viewed by 404 Media that since hackers obtained personal data about seven million of its customers in October 2023, including, in some cases "health-related information based upon the user's genetics," it has faced "over 50 class action and state court lawsuits," and that "approximately 35,000 claimants have initiated, filed, or threatened to commence arbitration claims against the company." It is seeking bankruptcy protection in part to simplify the fallout of these legal cases, and because it believes it may not have money to pay for the potential damages associated with these cases.
CEO and cofounder Anne Wojcicki announced she is leaving the company as part of this process. The company has the genetic data of more than 15 million customers. According to its Chapter 11 filing, 23andMe owes money to a host of pharmaceutical companies, pharmacies, artificial intelligence companies (including a company called Aganitha AI and Coreweave), as well as health insurance companies and marketing companies. Shortly before the filing, California Attorney General Rob Bonta issued an "urgent" alert to 23andMe customers: "Given 23andMe's reported financial distress, I remind Californians to consider invoking their rights and directing 23andMe to delete their data and destroy any samples of genetic material held by the company."
In a letter to customers Sunday, 23andMe said: "Your data remains protected. The Chapter 11 filing does not change how we store, manage, or protect customer data. Our users' privacy and data are important considerations in any transaction, and we remain committed to our users' privacy and to being transparent with our customers about how their data is managed." It added that any buyer will have to "comply with applicable law with respect to the treatment of customer data."
404 Media's Jason Koebler notes that "there's no way of knowing who is going to buy it, why they will be interested, and what will become of its millions of customers' DNA sequences. 23andMe has claimed over the years that it strongly resists law enforcement requests for information and that it takes customer security seriously. But the company has in recent years changed its terms of service, partnered with big pharmaceutical companies, and, of course, was hacked."
CEO and cofounder Anne Wojcicki announced she is leaving the company as part of this process. The company has the genetic data of more than 15 million customers. According to its Chapter 11 filing, 23andMe owes money to a host of pharmaceutical companies, pharmacies, artificial intelligence companies (including a company called Aganitha AI and Coreweave), as well as health insurance companies and marketing companies. Shortly before the filing, California Attorney General Rob Bonta issued an "urgent" alert to 23andMe customers: "Given 23andMe's reported financial distress, I remind Californians to consider invoking their rights and directing 23andMe to delete their data and destroy any samples of genetic material held by the company."
In a letter to customers Sunday, 23andMe said: "Your data remains protected. The Chapter 11 filing does not change how we store, manage, or protect customer data. Our users' privacy and data are important considerations in any transaction, and we remain committed to our users' privacy and to being transparent with our customers about how their data is managed." It added that any buyer will have to "comply with applicable law with respect to the treatment of customer data."
404 Media's Jason Koebler notes that "there's no way of knowing who is going to buy it, why they will be interested, and what will become of its millions of customers' DNA sequences. 23andMe has claimed over the years that it strongly resists law enforcement requests for information and that it takes customer security seriously. But the company has in recent years changed its terms of service, partnered with big pharmaceutical companies, and, of course, was hacked."
Who saw that coming (Score:2)
Re: (Score:3)
Re: (Score:3)
If 23andMe were incorporated in Europe the GDPR would have prevented that. Yet more evidence that the USA is a data privacy nightmare.
Re: (Score:2)
What id does do, however, put strict protections on what the new owner can do with that data.
They cannot, for example, say "oh hey, we have this data we got when we bought this company... but we don't consider ourselves bound by the contract that bound that company to the subject of that data!"
Re: (Score:2)
Re: (Score:2)
Even better: Ancestry has deep ties to the Church of Jesus Christ of Latter Day Saints; so the mormons likely have your relatives' DNA data.
Re: (Score:2)
Y'all worried about nothing.
Like let's do a best-case/worst-case scenario:
Best case:
1. Company is sold to another and continues as it is, and curtailing some features that are money sinks.
Worst case:
2. Company is sold and all physical samples are destroyed because that's likely what is costing them the most money
Like two of my family members who are deceased are on it. They are dead, they aren't going to protest or delete their data.
Realistically any damage that could have been done, has been done already.
Re: (Score:2)
Even better: Ancestry has deep ties to the Church of Jesus Christ of Latter Day Saints; so the mormons likely have your relatives' DNA data.
IIRC, the interests of the mormons in genealogy is so they can find family members and baptize them post mortem (IIRC, the premise is that dead you will have the opportunity to accept this and join them in the afterlife, or refuse it and go back to nothingness). I don't believe they have any purpose further than this, which makes the above a minor concern at best.
gonna be sold to second-rate market (Score:4, Interesting)
Xi, Putin, Bibi, X, and CIA: "Pass, we already swiped a copy."
Re: (Score:1)
Re: (Score:3, Interesting)
Re:gonna be sold to second-rate market (Score:4, Insightful)
Re: (Score:3)
What a deeply depressing post.
Sorry, dude[tte]
Re: (Score:1)
Re: (Score:3)
But hey, Democrats have been and still are the party of the KKK, so...
What do you mean "still are?" [wikipedia.org]
Re: (Score:2)
Re: (Score:2)
Would you like to make an argument that they're wrong? Because they're not, and I think you know that.
Re: (Score:3)
Southerners these days don't tend to vote Democrat so much (in case you haven't noticed)
No party is the party of the KKK, now, or originally.
However, in the past, there was a large cross-section between southern Democrats and the KKK, and today there is a large cross-section between southern Republicans and the KKK.
In case you're ignorant, now you know better. If you're just a gaslighting
Re: (Score:2)
I can get you 15 million copies (Score:5, Funny)
Of half the DNA of one person, best I can do.
Re: I can get you 15 million copies (Score:2)
I'm surprised that nobody mentioned any moms.
Re: (Score:2)
Mixed feelings. (Score:3)
Re:Mixed feelings. (Score:5, Informative)
Re: (Score:2)
Re: (Score:3)
I think this battle is lost. It is unavoidable for the authorities to one day get a hold on a 15 million people database. Assuming your concern is USA, and assuming that 23andMe has the largest fraction of their customer base in this country, this is about 1 person over 22. Most of American middle class probably has a remote cousin in there. Most criminal investigations just aren't valuable enough to dedicate resources to genetic genealogy.
Re: (Score:2)
This whole 23andMe thing has been a joke and now the joke is on all of us even though we never used their service. I think that this kind of data is valuable for medical research but it should be anonymized and only allowed to be used in ways that you approve. If the company dissolves, then your data should dissolve with it, it shouldn't be an asset that can be traded.
Anonymous (Score:2)
>"DNA of 15 Million People For Sale In 23andMe Bankruptcy"
There are good reasons I never participated in such nonsense and warned many others about this. And that is one of them.
One day, some company will come along and allow ANONYMOUS methods to pay, submit a sample, and only you get your own data results, so they can't belong to or been seen (at least with ID) by anyone else. There is probably no data about you more sensitive than your DNA.
Re: (Score:3)
The system doesn't do anything for your privacy if close relatives aren't as careful as you are.
Looks like the cloned a slashdot article (Score:2)
Need USA federal PII and biometrics law (Score:3)
We really need a federal level Pii and biometrics law forcing companies to delete your data, all backups and all 'anonymized metadata derived off that data' after 5 years if they have not received a manual opt-in from a user.
There also needs to be a required notification of the company is forced to give the data to another entity because of some regulation or action.
Re: (Score:2)
Clarify: The company must notify each person whose pii and data is forced to be shared with a third party. The notification would need to be an email or postal letter and not a general notice on the website or government filing.
Dramatic headline contradicted by the article (Score:2)
This is a Chapter 11 filing, which is a financial restructuring designed to restructure its debt obligations. They are NOT auctioning off customer DNA. Privacy commitments are still in force, and wouldn't be affected by this type of bankruptcy filing.
Re: Dramatic headline contradicted by the article (Score:2)
They filed for chapter 11 to look for a buyer for the company, or parts of it. It is right there in TFS
Re: (Score:2)
23andMe is already a publicly traded company. That means that people are buying and selling parts of the company ALL THE TIME. What's different in this case, is that they are looking for someone to buy a significant number, maybe all, of the share of stock. In this process, nothing changes about the charter of the company, the bylaws, or the protections (such as they are) for the DNA database they possess. The new buyer couldn't just "auction off" DNA profiles because they want to, that's not how a sale of
Re: (Score:2)
If they fail to find a buyer and the company is liquidated, the assets will be sold to pay their creditors. They have no cash.
Their total stock value is less than 20 million now. They're losing more than that every quarter now.
The protection of the DNA database is pretty much nothing
We may make changes to this Privacy Statement from time to time. We’ll let you know about those changes here or by reaching out to you via email or some other contact method, such as through in-app notification, or on another website page or feature.
They can change these terms when ever they want, and tell you about it however they want, without prior notice.
If we are involved in a bankruptcy, merger, acquisition, reorganization, or sale of assets, your Personal Information may be accessed, sold or transferred as part of that transaction and this Privacy Statement will apply to your Personal Information as transferred to the new entity. We may also disclose Personal Information about you to our corporate affiliates to help operate our services and our affiliates’ services.
That right to change the terms at will extends to anyone who buys it.
Re: (Score:2)
Your interpretation is correct. Also, my statement is correct. This bankruptcy changes nothing that wasn't already a risk before the bankruptcy. In one way, bankruptcy increases customer protections slightly because any deal has to be approved by a judge.
Re: (Score:3)
Here's what NPR says on the subject:
Everybody's worried about what a new company can do with the data — and that is a concern — but frankly some of the things that people are worried about, 23andMe already can do or already does.
https://www.npr.org/2025/03/24... [npr.org]
Your data is never safe (Score:3)
The terms you agreed to when you gave them your genetic data was to allow them to update those terms in the future, with nothing more than a notice on their website, and an optional email.
The buyers of the data inherit that right to change the terms to what ever they want
Re: (Score:3)
The terms you agreed to when you gave them your genetic data was to allow them to update those terms in the future, with nothing more than a notice on their website, and an optional email.
The buyers of the data inherit that right to change the terms to what ever they want
However, for California residents, additional protections apply today. If your state has not guaranteed your rights to your genetic data, now is a good time to call your state or federal legislative representative and demand changes to protect your rights to be you (whatever that means for you).
Not the whole story (Score:2)
CEO and cofounder Anne Wojcicki announced she is leaving the company as part of this process.
As reported elsewhere [entrepreneur.com], Wojcicki's offer to buy the company was rejected by the board. She's now leaving the company so that she'll be in a position to bid on it in the bankruptcy sale.
Re: (Score:1)
So let me get this straight. She runs the company into the ground, and then she wants to buy it out of bankruptcy, and leave the shareholders and creditors holding the bag? How Trumpy of her.
Good chance for a study (Score:1)
You can buy the data and find o