Oklahoma AG to 23andMe consumers: Delete your data

Yahoo

11-05-2025

Oklahoma Attorney General Gentner Drummond is alerting the state's consumers the genetic-testing company 23andMe plans to sell all its corporate assets, which could include users' genetic data. The company filed for bankruptcy in March.
"The implications of 23andMe selling genetic information to the highest bidder are understandably very concerning to Oklahomans who have used the company's services," Drummond said in a news release May 9. "While the situation is troubling, there are easy steps that consumers can take to proactively safeguard their privacy."
In the release, the AG listed a step-by-step process for consumers to delete their data from their 23andMe accounts.
The genetics and biotech company filed for Chapter 11 bankruptcy in March following a major data breach in 2023 that impacted over 6 million customers, led to a decreased demand of the service and resulted in a $30 million settlement.
On its website, 23andMe stated that regardless of who takes ownership of the company, consumers' data will remain private.
"The Chapter 11 filing does not change how we store, manage and protect customer data. Our users' privacy and data are important considerations in any transaction, and we remain committed to our users' privacy and to being transparent with our customers about how their data is managed. Any buyer of 23andMe will be required to comply with our privacy policies and applicable law with respect to the treatment of customer data."
Related: Why are so many businesses closing? Joann, Hooters bankruptcy; what Oklahomans should know
In 2006, 23andMe started selling DNA genetic testing kits to consumers through its website portal and quickly became a leading company in the genotyping industry, which provided consumers a look into their ancestral family tree.
By providing additional features focused on health, such as blood testing and health predisposition, the company rivaled its competitors, such as Ancestry.com.
In October 2023, the company experienced a mass data breach, exposing nearly half its users to privacy leaks. In a Notification of Breach to the State of California directed at consumers, the company divulged that an investigation determined a threat actor accessed users' Family Tree profile, including display names, relationship labels, shared DNA percentages with other users, self-reported location, and birth year.
The company then worked with third-party response experts to access the damage.
"Based on our investigation, we believe a threat actor orchestrated a credential stuffing attack to gain access to certain 23andMe accounts, including your account," the company wrote affected consumers. "Once the threat actor accessed your account, they also accessed certain information in your account."
More: Canoo, the electric vehicle startup that was promised $100 million in incentives, files for bankruptcy
The company filed for bankruptcy in March after the data breach damaged its reputation and led to shares falling by 50% at that time. In a news release, 23andMe Board Member Mark Jensen released a public statement on behalf of the company.
"After a thorough evaluation of strategic alternatives, we have determined that a court-supervised sale process is the best path forward to maximize the value of our business," he said.
Contributing: Reuters
This article originally appeared on Oklahoman: Drummond alerts 23andMe users to delete their data