In March 2025, 23andMe filed for Chapter 11 bankruptcy in the United States. The company owed creditors. Its consumer business had collapsed. Its stock had been delisted. And its most valuable remaining asset was the genetic profiles of 15 million people. Court filings named that database as the prize a buyer might acquire.
The California Attorney General issued an unusual public notice. It didn’t wait for the bankruptcy process to play out. It told 23andMe customers directly: delete your data now, before it can be sold to whoever buys the company’s assets. That’s not standard regulatory boilerplate. That’s an alarm.
And the sale did happen. In June 2025, a US bankruptcy court approved the transfer of 23andMe’s assets, over the objections of more than 30 states. The genetic database went to TTAM Research Institute, a nonprofit founded by 23andMe’s own former CEO, for $305 million. The sale closed in July 2025, and the business now operates as a nonprofit (reregistered as the 23andMe Research Institute). The buyer agreed to stronger privacy commitments as a condition of the deal, including continued deletion rights. But the court found that no fresh customer consent was needed to transfer the data at all. That is the precedent this case sets.
This is not a hypothetical scenario about what could go wrong with consumer DNA testing. It already went wrong. The question now is what it means for the tens of millions of people who sent their saliva to a lab expecting a fun ancestry report. And what it means for their relatives who never consented to anything.
What genetic testing companies actually collect
When you mail in a saliva sample to 23andMe, Ancestry, or any similar service, you’re not just getting an ancestry pie chart in return. The company gets your raw SNP data — single nucleotide polymorphisms, the points in your genome where people commonly vary. A standard consumer test reads hundreds of thousands to over a million of these positions. That raw file is the foundation of everything else.
From that data, companies build:
Disease risk predictions. 23andMe offers reports on predispositions to BRCA1 and BRCA2 variants — genes associated with elevated breast and ovarian cancer risk. Reports on Alzheimer’s predisposition. Type 2 diabetes. Parkinson’s. These aren’t diagnoses. They’re probabilistic estimates. But they’re derived from your actual genome and they sit in a database alongside your name and email address.
Ancestry composition. The ancestry breakdown — the part people share on social media — is derived from the same raw data. It identifies ethnic and geographic heritage in ways that can be highly sensitive depending on context.
Family relationships built from the database. This is where it gets genuinely strange. Services like 23andMe’s DNA Relatives feature map your genetic connections to other users. The more people who test, the more detailed this picture becomes. You may share genetic data with a half-sibling you didn’t know existed. You may be connected — without asking — to a relative who tested years ago. The network effect means the database’s value grows with every new customer.
Voluntarily entered health and behavioral data. Users who participate in research surveys add layers of information: medical history, medications, sleep patterns, mental health, diet. This is opt-in, but once entered, it compounds what the company knows.
The cumulative picture is unlike anything else in consumer data. It’s not what you searched for or where you travelled. It’s your biology.
Why genetic data is categorically different
You can change your password. You can get a new credit card number. You cannot change your genome.
Every other data breach has a mitigation. If your email address is exposed, you can change it. If your location history is leaked, you can change your phone. Genetic data has no equivalent recovery. Once it’s out, it’s out — permanently, and for every biological relative you have.
This creates a consent problem that has no clean solution. When you test your DNA, you’re also implicitly sharing information about your parents, your siblings, your children. They haven’t agreed to anything. Their genetic variants are partially readable from yours. A study published in Science in 2018 estimated the reach of this. With a database covering just 2% of a population of Northern European descent, it becomes possible to identify almost any individual. Not from their own profile, but from their relatives’ profiles. The implication is that opting out of these databases eventually becomes impossible for anyone with tested relatives.
Law enforcement has already exploited this. In 2018, investigators used GEDmatch — a genealogy site where users voluntarily upload raw DNA files — to identify suspects in the Golden State Killer case. The site’s terms of service at the time did not anticipate this use. After the investigation became public, GEDmatch changed its policies and was eventually acquired by Verogen, a forensic genomics company. The genealogy database became a forensic tool. Users who uploaded their DNA for family history research were, without knowing it, participating in a law enforcement resource.
FamilyTreeDNA went further. In January 2019, a BuzzFeed News investigation revealed that the company had proactively agreed to let the FBI search its database of customer DNA profiles. It did so without telling its customers, without a legal order, and before any subpoena process. The company’s founder subsequently defended the decision on national security grounds. Users had no idea this was happening when they tested.
The insurance dimension is equally serious. In the United States, GINA — the Genetic Information Nondiscrimination Act — prohibits health insurers and employers from using genetic data in coverage and hiring decisions. That sounds protective. It isn’t complete protection. GINA explicitly does not cover life insurance, disability insurance, or long-term care insurance. An insurer issuing a life insurance policy can, in many US states, ask about known genetic risks and factor them into underwriting. The protection has a substantial gap.
The 2023 breach: how credential stuffing became a family tree problem
In October 2023, 23andMe disclosed a breach. Attackers had used credential stuffing to access around 14,000 accounts directly. That means taking username and password combinations from other breaches and trying them on 23andMe accounts. That sounds bad but manageable.
Then 23andMe disclosed the actual scope. Compromised accounts had the DNA Relatives feature active. So attackers could harvest profile data from accounts that hadn’t been directly breached, but were connected in the genetic network. The final count: approximately 6.9 million profiles were affected.
The company’s initial communications framed this primarily as a credential issue. Users should have used stronger passwords or enabled two-factor authentication. The argument was technically accurate and deeply misleading. One compromised account could expose data from millions of connected accounts. That danger of the DNA Relatives feature was a design choice 23andMe made. Customers had no way to anticipate that enabling a family history feature would make them vulnerable to breaches targeting strangers who happened to share DNA.
23andMe subsequently changed its approach to two-factor authentication and the DNA Relatives feature. By that point the data was already circulating. The 6.9 million affected profiles included a large proportion of users with Ashkenazi Jewish heritage and Chinese ancestry, the groups explicitly targeted in the dark web dataset. That adds an ethnic profiling dimension to an already serious breach.
The rest of the industry
23andMe’s collapse focused attention on the sector, but the rest of the industry operates on similar models.
Ancestry is the largest consumer DNA company by database size — over 22 million customers. It is owned by Blackstone, the private equity firm. Blackstone’s business model is not consumer genomics. It’s capital allocation. Ancestry is an asset on a balance sheet, which means its genetic database could eventually be subject to the same acquisition pressures that collapsed 23andMe’s independence.
MyHeritage, an Israeli company, operates a large global genealogy service with DNA testing. Its privacy policy, like most in the sector, allows for data sharing with research partners and reserves rights around future business transfers.
Dante Labs is an Italian company that offers more clinical-grade whole genome sequencing rather than SNP array testing. Whole genome sequencing reads far more of your genome than a consumer ancestry test. The data is correspondingly more sensitive and potentially more actionable for health or insurance purposes.
Then there’s GEDmatch, now under forensic ownership, which occupies an odd position: it doesn’t test DNA, but it accepts raw DNA uploads from any source. Users who tested with 23andMe or Ancestry and wanted to search a broader database would upload their raw file to GEDmatch. That file now sits in a forensic genomics company’s database.
Genetic privacy in India
Direct-to-consumer genetic testing is a growing market in India. Companies including Mapmygenome and Xcode Life offer ancestry, carrier status, and health predisposition testing to Indian consumers. The sector is small compared to the US but expanding.
The Digital Personal Data Protection Act 2023 classifies genetic data as sensitive personal data, which carries higher processing obligations. That classification matters in principle. In practice, enforcement of DPDPA for cross-border data transfers is still developing — the implementing rules were not fully finalised when the law came into force.
The critical issue for Indian users is jurisdiction. 23andMe and Ancestry are companies incorporated and operating in the United States. When an Indian customer sends them a saliva sample, the resulting data is held under US law, not Indian law. DPDPA does not reach into a US bankruptcy court. The California Attorney General’s warning about deletion covered 23andMe’s user base broadly. But an Indian user has limited legal leverage over a US company in a US bankruptcy proceeding.
Indian users who have tested with US-based companies should not assume that Indian privacy law offers practical protection for data held on US servers.
What you should do now
If you have a 23andMe account: Delete your data. The path is: Account settings > 23andMe Data > Delete Data. This initiates deletion of your genetic data, health reports, and associated account information. The process takes a few weeks. The 2025 sale to TTAM/23andMe Research Institute has closed, but customer deletion rights were preserved as a condition of that sale, so the option still works. Use it if you no longer want your genome in the database.
Before you delete, download your raw data file if you want to keep a local copy. You can save the file to an encrypted drive and have the data without it sitting in a corporate database. Once you’ve confirmed the download, proceed with deletion.
Understand what deletion does and doesn’t cover. 23andMe ran large-scale studies with pharmaceutical partners, including GlaxoSmithKline. If you participated in those research programs, your data may have already been incorporated into research datasets. 23andMe’s terms indicated that research data is anonymised before being shared. But anonymisation of genetic data is not as durable as anonymisation of other data types. There is no mechanism to reliably recall data already shared with research partners.
For other services: Read the privacy policy for three things specifically. Whether the company shares data with third parties. How it responds to law enforcement requests. And what happens to your data if the company is acquired or goes bankrupt. Most policies address this under a business transfer clause. The standard language allows transfer of your data to acquirers.
GEDmatch specifically: Do not upload raw DNA to GEDmatch unless you’ve read its current terms and are comfortable with law enforcement matching. Since its acquisition by Verogen, the default opt-in status for law enforcement matching has changed more than once. Verify the current setting, not what you remember from when you first registered.
For Indian users considering testing: If you’re looking at Indian providers like Mapmygenome or Xcode Life, confirm where your data is stored and processed. Domestic storage means DPDPA applies more directly. If you’re considering US providers for a wider database, understand that your data will be governed by US law.
The actual risk model
The concern with genetic data isn’t only a big, dramatic breach. It’s accumulation. It’s the quiet business transfer. It’s the privacy policy clause that says “we may share your data with our affiliates and business partners” buried on page eight. It’s the bankruptcy where your genome becomes a line item in a creditor settlement.
Your genome is permanent. It connects you to your relatives. It can reveal disease risk, ancestry, and family relationships you didn’t know about and didn’t consent to share. Law enforcement can use it. Insurers in some jurisdictions can use it. And the company holding it can fail, be acquired, be subpoenaed, or be breached.
None of this means genetic testing has no value. It can reveal clinically actionable health information. It can connect adoptees with biological families. The technology is real and the benefits are real.
But the privacy trade-off deserves honest accounting. The 23andMe bankruptcy wasn’t a failure of a single company. It was a preview of what happens when sensitive biological data is treated as a consumer product asset — which is how every company in this sector treats it.
Delete what you can. Understand what you can’t.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.