23andMe Files for Bankruptcy Protection Amid Data Breach Fallout

In a significant turn of events, 23andMe, the genetic analysis firm, has filed for bankruptcy protection as the company seeks assistance in facilitating a sale. This announcement comes more than a year after the company disclosed a major data breach that compromised millions of customer records. Alongside this development, CEO Anne Wojcicki has stepped down from her position.

Reports indicate that the company's stock is currently valued at just $0.41 per share, a steep decline from a prior offer of $2.53 per share rejected by the board in recent weeks. The total valuation of 23andMe has now plummeted to approximately $11 million, a stark contrast to its valuation of $3.5 billion in 2021. Market assessment shows a notable drop, with the company's shares losing around 75% of their value in 2024, and more than 99% since their peak in early 2021.

The data breach, publicly acknowledged in October 2023, revealed that sensitive information from users who had submitted their genetic data was being offered for sale on the dark web. Cybercriminals utilized a technique known as credential stuffing, allowing them to access user accounts by exploiting stolen login details from other services. This breach reportedly affected nearly seven million users, leading to a class-action lawsuit that has resulted in a settlement of $30 million for the affected individuals.

In light of the ongoing turmoil, all members of the board except for Wojcicki resigned in September, expressing disagreements regarding the company's strategic direction. Wojcicki had been considering taking the company private, but a recent attempt to do so failed in March. Now, with bankruptcy proceedings underway, the company is looking to the court for aid in executing a sale.

California's Attorney General Rob Bonta recently emphasized the rights of consumers in the state to have their data deleted, a provision that also extends to customers in Europe under the General Data Protection Regulation (GDPR). Users have the option to request the destruction of not only their personal data but also any genetic material held by 23andMe. There are concerns that such material could be mishandled during the sale process, especially given previous revelations that the company may not fully delete all data even if a user requests account deletion.