Is your DNA data actually private? What the 23andMe collapse taught us

You can change a leaked password in thirty seconds. You cannot change your genome. That single fact is why the privacy questions around consumer DNA testing are different from every other account you have online — and why the collapse of the company that made at-home genetic testing mainstream is worth understanding before you send your saliva to anyone.

What actually happened with 23andMe

In 2023, attackers used credential stuffing — logging in with passwords leaked from other sites — to break into about 14,000accounts. From there they used the “DNA Relatives” feature, which links you to genetic matches, to reach the profiles of roughly 6.9 million people connected to those accounts. The exposed data included ancestry details and, for some, health-related information.

Then the business itself unwound. Its market value fell from roughly $6 billion at its 2021 peak to under $50 million — more than 99% — and in 2025 the company filed for Chapter 11 bankruptcy. That turned an abstract worry into a concrete one: in a bankruptcy, a company’s assets get sold — and for a genetics company, the database of customers’ DNA is the asset. Several state attorneys general issued alerts urging residents to download and delete their data before it changed hands.

The point isn’t that one company was uniquely careless. The point is structural: once your genome lives on someone else’s servers, its fate is tied to their security, their business model, and their solvency — none of which you control.

Why genetic data isn’t like other data

Four things make a genome uniquely sensitive to store off your own device:

• It’s permanent.A breached credit card gets reissued. A breached genome is yours for life — and it doesn’t get less revealing with time.
• It isn’t only yours. Your DNA overlaps substantially with your siblings, parents, and children. Sharing yours partially exposes theirs, whether or not they ever opted in.
• It can re-identify you.Research has repeatedly shown that “anonymized” genetic data can be linked back to named individuals by cross-referencing public genealogy databases.
• The law only half-covers it. In the U.S., the Genetic Information Nondiscrimination Act (GINA) bars genetic discrimination in health insurance and employment — but it does not cover life, disability, or long-term-care insurance.

Questions worth asking before you upload your DNA anywhere

Consumer genetics can be genuinely useful. The goal isn’t to avoid it — it’s to know what you’re agreeing to. Before you send a raw file or a saliva kit to any service, read for the answers to these:

• Is my raw genetic data uploaded to their servers, or processed on my own device?
• If it’s uploaded, can I delete it — and does “delete” mean the sample, the file, and the derived results?
• Who else can access it: research partners, advertisers, law enforcement, an acquirer if the company is sold?
• Is my data used to train models or shared with third parties by default, and can I turn that off?
• What happens to it if the company is acquired or goes bankrupt?

If a service can’t answer these plainly, that’s an answer in itself.

Educational overview, not legal or medical advice. Sources include public reporting on the 2023 23andMe security incident and its 2025 Chapter 11 filing, U.S. state attorney-general consumer advisories, and the text of the Genetic Information Nondiscrimination Act of 2008. Coverage of consumer genetics is general and not specific to any one person’s situation.