23ANDME

Institutional Archetype

THE VAULT — The archetype is the custodian whose asset outlasts the custodian. 23andMe did not build a weapon and did not write anyone’s rules; it accumulated the one substance a person cannot change, cannot rotate, and cannot leave behind, and it accumulated it at scale, voluntarily, from paying customers. The structural power is not in what the company did with the vault. It is in the category error that let there be a vault: a genome is not a password, and once it is digitized, indexed, and made searchable, the question stops being is my data safe and becomes who holds admin, and what happens to the vault when the company that built it fails. 23andMe is the first firm to answer that second question in open court.

Mandate & Origin

23andMe Inc. was founded April 2006 in Mountain View, California, by Anne Wojcicki (cross-reference anne-wojcicki.md), Linda Avey, and Paul Cusenza. Its consumer product was direct-to-consumer genotyping: a saliva kit returned for a prepaid mailer, in exchange for ancestry composition and health-risk reports. In May 2007 Wojcicki married Sergey Brin, co-founder of Google, and Google invested in 23andMe’s Series A; Brin and Wojcicki separated in 2013 and divorced in 2015. The kinship overlap between the two companies is a permanent feature of the corporate record, cited here as documented fact and not as a claim of operational entanglement (Britannica — Anne Wojcicki; Sequoia Capital profile; Wikipedia — Anne Wojcicki).

The regulatory arc is documented. In November 2013 the FDA ordered 23andMe to stop marketing its Personal Genome Service health reports until it secured 510(k) clearance; the company complied and pivoted to ancestry-only reports in the US for two years. In February 2015 and April 2017 the FDA then authorized the first direct-to-consumer carrier-status test (Bloom syndrome) and the first DTC genetic-health-risk reports for ten conditions, including late-onset Alzheimer’s and Parkinson’s (FDA warning letter, 2013-11-22; FDA press release, via Wayback).

Funding & Backers

The funding model is the finding. 23andMe’s recurring-revenue thesis never materialized — a person needs their genome sequenced once — so the company monetized the database itself. In July 2018 GlaxoSmithKline announced a $300 million equity investment and a four-year exclusive R&D collaboration to use the genotype database for drug-target discovery: the first major commercial monetization of the customer database as a corporate asset. In February 2021 the company agreed to go public via SPAC merger with VG Acquisition Corp., a vehicle sponsored by Sir Richard Branson’s Virgin Group, at a valuation near $3.5 billion; ticker ME began trading on Nasdaq on 2021-06-17 and touched an intraday market cap near $6 billion in late 2021. The stock then slid to penny-stock territory and a Nasdaq delisting notice, a roughly 96–98% decline from its 2021 high (GSK press release; Bloomberg — SPAC valuation; CNBC — Nasdaq debut; Fortune — decline timeline).

The load-bearing fact: a genotype database built from paying customers under a consumer privacy policy became, in sequence, a pharmaceutical R&D input, a public-company asset, and finally an entry on a bankruptcy estate’s schedule. Who pays for a genome, and what the genome is worth to them, is part of what the genome became.

Actions & Leadership Choices

The breach (2023), judged on the record. Between April and September 2023 a credential-stuffing attacker ran systematic logins against 23andMe accounts using passwords sourced from unrelated prior breaches — a campaign that ran roughly five months undetected. The company disclosed it on 2023-10-06 after the attacker offered DNA Relatives data for sale on hacker forums. Direct compromise reached about 14,000 accounts; through the opt-in DNA Relatives feature the attacker scraped roughly 5.5 million additional users and about 1.4 million Family Tree users, for a SEC-disclosed total near 6.9 million — roughly half the customer base. A peer-reviewed forensic post-mortem characterized the operational posture as not requiring two-factor authentication at the time and not flagging sustained large-scale login attempts — a characterization attributed to the paper, not asserted here as a finding of negligence. The class action settled first at $30 million plus three years of credit monitoring, later restructured in bankruptcy to $50 million.

The board break (2024). On 2024-09-17 all seven independent directors resigned in a single coordinated action — Roelof Botha (Sequoia), Patrick Chung (xFund), Sandra Hernández, Valerie Montgomery Rice, Richard Scheller, Peter Taylor, and Neal Mohan. Their joint letter cited the absence of a “fully financed, fully diligenced, actionable proposal that is in the best interests of the non-affiliated shareholders” and a strategic disagreement with the CEO over her stated intent to take the company private. The characterization is drawn from the directors’ own letter and the CEO memo as reported, not asserted as an independent judgment of anyone’s conduct.

The bankruptcy and the sale (2025). On 2025-03-23 23andMe Holding Co. and eleven affiliates filed Chapter 11 in the Eastern District of Missouri (Case No. 25-40976, Judge Brian C. Walsh), disclosing about $277 million in assets against $215 million in liabilities; the CEO resigned that day and Joseph Selsavage became interim CEO. The DOJ’s US Trustee appointed Professor Neil Richards as Consumer Privacy Ombudsman under 11 U.S.C. § 332; his roughly 200-page report concluded it was “highly unlikely” typical customers had understood, at click-through, that their genetic data could be sold in a bankruptcy estate. An open auction ran with no stalking-horse bid: Regeneron Pharmaceuticals won the first auction at $256 million (2025-05-14); TTAM Research Institute, formed mid-process by co-founder Wojcicki, submitted a topping bid, the court reopened the auction, and TTAM prevailed at $305 million. The sale order (2025-06-27) dismissed the remaining genetic-privacy-act objections of California, Kentucky, Tennessee, Texas, and Utah on the theory that the opt-in requirement for third-party sales did not apply because the data would remain private under TTAM; closing followed 2025-07-14. The plan was confirmed 2025-12-05 and the lead debtor renamed Chrome Holding Co.

The government response. A bipartisan coalition of 28 state attorneys general, led by New York AG Letitia James, filed a complaint and objection on 2025-06-09 arguing genetic data could not be transferred without each customer’s informed consent — allegations the court rejected. The Senate Judiciary Committee held 23 and You: The Privacy and National Security Implications of the 23andMe Bankruptcy on 2025-06-11; Sen. Grassley framed the hearing in national-security terms (“Genetic data is a particularly potent weapon”; “There is no data privacy law that protects genomic data”), and Sen. Josh Hawley told Selsavage he hoped customers would “rush to the courthouse … to sue you into oblivion.” At the House Oversight hearing the day before, Selsavage testified that since the bankruptcy announcement “1.9 million customers” had requested deletion — about 15% of the base on his own arithmetic. In April 2025 the United States filed a notice that the transaction might be subject to CFIUS review and DOJ’s Data Security Program under 28 CFR Part 202 (implementing EO 14117); commentators noted the CFIUS “foreign adversary” trigger did not cleanly apply because the winning bidder was US-based and founder-controlled. The Don’t Sell My DNA Act (Cornyn, Grassley, Klobuchar, May 2025) would add “genetic information” to the Bankruptcy Code’s definition of PII.

CONDUCT verdict: CONFLICTED — a for-profit genetic-data company whose business model concentrated the one asset a customer cannot revoke, whose opt-in relative-graph feature turned a few compromised logins into a 6.9-million-user breach, and whose failure delivered its database to a founder-controlled nonprofit through a court process rather than individual re-consent. The disposition may prove better for customers than a private-equity or foreign buyer would have been — a defensible reading the file does not dismiss — but the mechanism, not the buyer, is the finding, and no group is characterized here as having committed a crime, breached a fiduciary duty, or acted in bad faith.

Sources: Research dossier: 23andMe, Bankruptcy, and the Genetic Database; Kroll restructuring portal — primary docket, In re 23andMe Holding Co., 25-40976 (E.D. Mo.); 23andMe SEC EDGAR filings (CIK 0001804591); FDA warning letter (2013-11-22); GSK–23andMe collaboration press release (2018); Bloomberg — SPAC valuation (2021); Holthouse et al., forensic analysis of the 2023 breach (arXiv 2025); Reuters — $30M breach settlement (2024-09-13); CNBC — independent directors resign (2024-09-17); GenomeWeb — TTAM $305M auction win; NPR — sale approved (2025-06-30); Senate Judiciary hearing page; Lawfare — Privacy, Consent, and National Security After the 23andMe Bankruptcy.