23andMe is for sale — and so are 15 million people's genetic records

After a brutal data breach and a wave of lawsuits, 23andMe filed for Chapter 11 bankruptcy — and now, the consumer genetics company is looking for a buyer. On the table are the business, the brand, and the DNA profiles of more than 15 million users.

The bankruptcy filing, submitted on Sunday, March 23, caps off months of turmoil following a major hack in October 2023. That breach exposed the personal and health-related genetic data of at least 7 million customers. The fallout was swift and far-reaching, resulting in more than "50 class action and state court lawsuits" alleging that 23andMe failed to adequately protect its users' most sensitive data.

Now, in an attempt to streamline its legal mess, the company has entered Chapter 11 — a move that also opens the door for a potential sale. According to court filings, 23andMe is in debt to a mix of pharmaceutical firms, health insurers, AI startups like Aganitha AI and CoreWeave, marketing agencies, and pharmacies.

Meanwhile, California’s Attorney General Rob Bonta issued a pointed warning to 23andMe users last Friday: don’t wait.

"Given 23andMe’s reported financial distress," he said in a statement, "I remind Californians to consider invoking their rights and directing 23andMe to delete their data and destroy any samples of genetic material held by the company."

How to delete 23andMe data

With 23andMe officially up for sale, there’s no telling who might end up owning the company — or what they’ll want with the genetic data of millions of users. Over the years, 23andMe has repeatedly claimed it takes data privacy seriously. But at that same time, it partnered with pharmaceutical companies and suffered a massive breach.

If you’re thinking about pulling the plug on your data before a potential buyer steps in, you can do that through the 23andMe app:

• Head to the “23andMe Data” section

• Tap “View,” then “23andMe Data”

• Select “Permanently Delete Data”

One odd wrinkle: on the deletion page, 23andMe includes a Q&A that attempts to reassure users. It reads:

“If the company does change ownership in the future, your data will remain protected under the current 23andMe Privacy Policy unless you are presented with materially new terms, with appropriate advanced notice to review those material changes as required by law.”

In other words, your data stays private... until it doesn’t.