A federal bankruptcy judge ruled Friday that California is barred from seeking financial damages from the successor company to 23andMe in connection with a 2023 data breach that exposed the genetic and personal information of an estimated 6.9 million customers.
U.S. Bankruptcy Judge Brian Walsh, presiding in St. Louis, determined that 23andMe’s Chapter 11 reorganization plan prevents California from pursuing monetary relief against Chrome Holding Co and an affiliated company. However, the state may still seek non-monetary remedies.
Judge Walsh gave California 14 days to either dismiss its May 28 lawsuit filed in San Francisco Superior Court, or revise the complaint to remove any requests for financial damages.
The ruling represents a significant setback for California Attorney General Rob Bonta, who had accused 23andMe of disregarding warnings that its systems had been compromised and minimizing the seriousness of the breach. Bonta had been pursuing what could have amounted to millions of dollars in civil penalties. His office did not respond to requests for comment.
In arguing against the ruling, the attorney general’s office contended that Congress never granted bankruptcy judges the authority to block state-level enforcement actions in state courts, warning that allowing such power could turn bankruptcy courts into what he called “a haven for wrongdoers.”
Judge Walsh pushed back on that characterization, writing that he “disagreed” that 23andMe’s reorganization plan created any such haven — and adding that even if it had, California would not be in a position to challenge it at this stage.
“Because the state was a party to the Chapter 11 case and was given a fair chance to challenge this court’s subject-matter jurisdiction, the state cannot challenge it now” by proceeding with its lawsuit, Walsh wrote in his decision.
California filed its lawsuit four months after Walsh had already approved the creation of a fund to settle most customer claims stemming from the data breach. On Tuesday, Walsh authorized an additional $32.46 million payment on top of $14.29 million that had already been distributed, bringing the total payout to $46.75 million.
23andMe, which was headquartered in Palo Alto, California, sought bankruptcy protection from creditors in March 2025. TTAM Research Institute, a nonprofit controlled by 23andMe co-founder Anne Wojcicki, purchased the company’s assets for $305 million last July.
