A federal bankruptcy judge has determined that California is barred from seeking monetary damages from the company that succeeded 23andMe in connection with a 2023 data breach that revealed genetic and other personal information for an estimated 6.9 million customers.
U.S. Bankruptcy Judge Brian Walsh, speaking from St. Louis, said the Chapter 11 reorganization plan put in place by the former 23andMe and its restructuring process prevents the state from pursuing financial relief against Chrome Holding Co and a related affiliate. Walsh added, however, that the state remains free to pursue non-monetary remedies.
The judge ordered California to take one of two steps within 14 days: either dismiss the May 28 complaint it filed in San Francisco Superior Court, or amend that complaint to strip out claims that seek monetary damages. The ruling means the attorney general’s effort to obtain civil fines tied to the breach cannot proceed in its current form.
California Attorney General Rob Bonta had accused 23andMe of failing to act on warnings that its systems were compromised and of understating the seriousness of the incident. His office has sought potentially millions of dollars in civil penalties. Bonta’s office did not immediately respond to requests for comment on Friday.
In arguing against the bankruptcy court’s authority to limit state enforcement actions, the attorney general contended that Congress did not empower bankruptcy judges to bar state law-based suits in state courts, and warned that allowing such authority could let bankruptcy proceedings become a - haven for wrongdoers, his filing said.
Judge Walsh rejected that view, writing that he "disagreed" with the suggestion that the reorganization plan had created such a haven. He further wrote: "Because the state was a party to the Chapter 11 case and was given a fair chance to challenge this court’s subject-matter jurisdiction, the state cannot challenge it now" by pursuing its separate lawsuit.
California’s case against the successor company came months after Walsh approved the establishment of a fund intended to resolve most U.S. customer claims arising from the 2023 breach. On Tuesday, Walsh authorized an additional payment of $32.46 million to that fund, supplementing $14.29 million that had been disbursed earlier, bringing the total payout to $46.75 million.
Palo Alto-based 23andMe filed for bankruptcy protection in March 2025. In July of the prior year, TTAM Research Institute, a nonprofit entity controlled by 23andMe co-founder Anne Wojcicki, acquired 23andMe’s assets for $305 million.
The court’s decision constrains California’s ability to obtain financial penalties through its May lawsuit but leaves open other forms of relief the state could seek. The next procedural step rests with the attorney general’s office, which must either withdraw the monetary claims in state court or face dismissal of the suit under the bankruptcy judge’s order.