Class Action Complaint Against 23andMe, Inc. Filed in California District Court Accuses Company of Data Negligence

A new class action lawsuit brought forward by Plaintiffs Monica Santana and Paula Kleynburd in the United States District Court, District Court of Northern California, against 23andMe, Inc. alleges negligence, breach of implied contract, invasion of privacy, and unjust enrichment in response to the company’s recent data breach. This legal action claims that 23andMe failed to take appropriate security precautions leading to a data breach compromising the personally identifiable information (PII) of millions of customers.

23andMe, Inc. is a biotechnology company that specializes in providing personalized genetic reports to its customers. With over 14 million customers globally, the company has access to an extensive database of genetic information, including ancestry, traits, and health risks. On or about October 6, 2023, 23andMe revealed that an unauthorized cyberattack had compromised the PII of its customers. This breach exposed sensitive information such as names, gender, date of birth, genetic ancestry results, profile photos, and geographical location. Cybercriminals accessed this information without authorization from users or the company. 23andMe alleges the lost information is the result of hackers exploiting instances where users recycled login credentials where usernames and passwords that were used on 23andMe.com were the same as those used on other websites that have been previously hacked. The company has also said it will contact defendants individually if they find out their data has been compromised.

The Defendant’s allege that the initial response and notice to affected customers was found to be lacking in several critical aspects. They state that the response failed to provide specific details about the breach, such as the mechanisms that allowed it to occur and whether the cybersecurity threat had been contained or eliminated. The complaint states that this lack of transparency left customers in the dark about the safety of their PII and the risk of future breaches. The complaint also alleges that 23andMe failed to follow industry and Federal Trade Commission guidelines around data security. Additionally, the complaint alleges that as a consequence of the data breach, the Plaintiffs and Class Members suffered a multitude of losses, including the present and imminent threat of fraud and identity theft, out-of-pocket expenses, and the loss of the benefit they expected from 23andMe’s services.

The plaintiffs in the case are seeking remedies that include actual and compensatory damages, reimbursement of out-of-pocket expenses, and injunctive and equitable relief to prevent future breaches and protect the affected individuals.

This case is likely to further heighten data security concerns, especially for consumer genetics companies that have access to significant genetic and personal health data for clients. 23andMe has not yet responded to the complaint.