===== 6464 =====
A self-serve genomics test sold years ago is still damaging healthcare privacy budgets. The tab just grew by $6M.
California closed its case against 23andMe this week, settling genetic-data claims for money the state keeps. July had already brought an $18M bill, paid out to a 42-state coalition, over the very same credential-stuffing episode. Roughly 6.9 million people had genetic records exposed in it, and 855,000 of them lived in California. A class action settled for $46.75M with court approval in July.
## Why states could argue it
The intrusion needed no zero-day. Attackers stuffed reused passwords against customer accounts and walked into profiles, because 23andMe had no meaningful detection in front of account authentication. Regulators argued the company should have known its consumer base was a target and built blocking controls anyway. Compliance officers should read that theory closely: a data holder can be penalized for an attack it failed to anticipate, not only one it failed to patch.
California refused to join the multistate action and sued separately. It then tried to block 23andMe's bankruptcy sale to TTAM Research Institute, the nonprofit controlled by co-founder Anne Wojcicki, arguing the genetic-data transfer violated the state's Genetic Information Privacy Act. A judge disagreed and barred the state from pursuing the buyer. Under the settlement, California drops its appeal and the sale proceeds.
## Biobanks should pay attention
Genetic information cannot be reissued. A credit card gets replaced; a genome does not. Consumer genomics sits next to clinical genetics, research repositories, and biotech partners, and the same credential problem shows up across all of them.
Former users should exercise their deletion rights rather than assume a new owner will offer them.
The $70.75M across all three settlement channels is a fair proxy for the real cost.
