Things have taken a turn for the worse for genetic testing company 23andMe.
CEO Anne Wojcicki has resigned, and the company recently filed for Chapter 11 bankruptcy, following the resignation of its board about six months ago over strategic disagreements.
The company has faced numerous challenges, including data hacks, a class-action lawsuit, and ongoing leadership tensions. These issues have placed 23andMe’s future in jeopardy as it seeks a buyer.
There are growing concerns that a sale could potentially lead to the selling of user data. The director of cybersecurity at the Electronic Frontier Foundation, a nonprofit focused on digital privacy, previously urged their following to delete their data from 23andMe, leading to significant engagement on social media.
23andMe states that the personal data they collect includes registration details such as birth dates, genetic information, saliva sample data, and self-reported information. However, a spokesperson for the company emphasized that customer information is not shared outside of their contracted laboratory unless consent is given. They also indicated that data is not shared with employers, insurance companies, or law enforcement agencies.
Despite these assurances, users remain anxious about the security of their personal information. James Hazel, a biomedical researcher, has said, “Data is data — once it’s out there, it’s very hard to control.”
For those concerned about their data, users can opt to delete their personal information in the “23andMe Data” section of their Account Settings. However, the company is legally required to retain some information. Their privacy statement explains that, even after deletion, some data, including Genetic Information, date of birth, and sex, will still be kept for compliance purposes. Users can delete their accounts at any time, and the company will begin the deletion process immediately upon request.
23andMe launched in 2006, initially enjoying a successful trajectory characterized by over $1 billion raised from investors by 2021. However, the company has faced significant hurdles since a data breach in 2023, where user data including names and birth details were found on the dark web. The company confirmed that hackers accessed data from nearly 7 million users and took five months to detect the breach. This incident resulted in a $30 million settlement for a class-action lawsuit.
Following the breach, several independent directors of the board resigned, expressing support for the company’s mission while noting strategic differences moving forward. In November, 23andMe laid off about 40% of its workforce due to cost-cutting measures, and it reported debts totaling $2.3 billion in an SEC filing. The company continues to operate while searching for a buyer.
Despite generating $299 million in revenue in 2023 and $219 million in 2024, 23andMe has never turned a profit, with its stock price plummeting after peaking in February 2021.