Research: 23andMe, Bankruptcy, and the Genetic Database

July 2, 2026

This page documents the bankruptcy and asset transfer of approximately 15 million customer genetic profiles from 23andMe Holding Co. — a for-profit Delaware corporation that went public via SPAC in 2021 — to TTAM Research Institute, a California nonprofit public benefit corporation founded by 23andMe co-founder Anne Wojcicki and incorporated in 2025. Every claim below about a real person or organization carries a source; where a characterization or an intent is at issue, it is attributed to whoever made it — the source, the court, or the named actor — and never asserted in our own voice.

The controlling record is the bankruptcy docket: In re 23andMe Holding Co., et al., Case No. 25-40976, United States Bankruptcy Court for the Eastern District of Missouri, Eastern Division, before the Honorable Brian C. Walsh. Twelve affiliated debtors; the lead debtor was renamed Chrome Holding Co. on emergence. The plan was confirmed 2025-12-05 and made effective the same date (Kroll restructuring portal — primary docket access).

Corporate history (2006–2024)

The bankruptcy (Chapter 11)

Filing. On 2025-03-23 (a Sunday), 23andMe Holding Co. and 11 affiliated debtors filed voluntary Chapter 11 petitions in the United States Bankruptcy Court for the Eastern District of Missouri, Eastern Division. The lead case, 25-40976, was assigned to Judge Brian C. Walsh. The filing disclosed approximately $277 million in assets against approximately $215 million in liabilities. Anne Wojcicki resigned as CEO on the petition date and was replaced on an interim basis by Joseph Selsavage, who held the CFO/CAO role; Wojcicki retained a board seat (23andMe press release on Chapter 11; Kroll restructuring portal; Yahoo Finance).

DIP financing. JMB Capital Partners Lending, LLC provided debtor-in-possession financing — an initial commitment of a $35 million senior secured term loan, later amended upward to $60 million, with a 2.00% commitment fee ($700,000, non-refundable) and a 4.00% exit fee on drawn amounts. The interim DIP order was entered 2025-03-26 and the final DIP order 2025-04-23. These docket-level terms rest on a secondary case summary and should be confirmed against the primary docket (Elevenflo case writeup; Kroll restructuring portal).

Consumer Privacy Ombudsman. The DOJ’s Office of the United States Trustee appointed Professor Neil Richards of Washington University School of Law as Consumer Privacy Ombudsman under 11 U.S.C. § 332, with an initial budget of $300,000. Richards filed an approximately 200-page report concluding — in his own words — that it was “highly unlikely” typical 23andMe customers had understood, when they clicked through the consumer terms, that their genetic data could be transferred in a bankruptcy estate sale (Elevenflo summary).

Bidding procedures. The bidding-procedures order was entered 2025-03-28. No stalking-horse bid was designated; the court ran an open auction. The first auction concluded 2025-05-14 with Regeneron Pharmaceuticals winning at $256 million. TTAM Research Institute, formed mid-process by Anne Wojcicki, then submitted an unsolicited topping bid, and the court entered a Final Proposal Procedures Order on 2025-06-04 reopening the auction (Kroll restructuring portal).

Second auction outcome. TTAM Research Institute prevailed with a $305 million bid; Regeneron declined to top. According to representations Wojcicki made to the court and reported in coverage, the TTAM bid was backed by an unnamed Fortune 500 company with a market capitalization above $400 billion and $17 billion cash on hand (23andMe press release on TTAM agreement, 2025-06-13; GenomeWeb).

Sale order and closing. The sale hearing was held 2025-06-17 and the sale order entered 2025-06-27 (Walsh, J.). The order also dismissed the specific genetic-privacy-act objections of California, Kentucky, Tennessee, Texas, and Utah, with Walsh ruling that the opt-in requirement for “third-party” sales of genetic information did not apply on the theory that the genetic information would remain private under TTAM. Closing followed on 2025-07-14 (NPR; TTAM closing press release; MobiHealthNews — the GIPA dismissal).

Plan confirmation. The plan confirmation order was entered 2025-12-05 and the plan consummated the same date; the lead debtor was renamed Chrome Holding Co. The Chapter 11 cases for all debtors other than Chrome Holding closed pursuant to an order dated 2026-01-21. Lemonaid Health was sold separately for $10 million to Bambumeta Ventures, LLC (closed 2025-12-05). The reorganized estate retained a residual arbitration-settlement liability of $9 million resolving approximately 35,000 individual breach-related arbitration claims (approved 2025-10-08). These docket-level details rest on a secondary summary and should be confirmed against the primary docket (Kroll restructuring portal; Elevenflo case writeup).

Sealed materials. Per the Kroll docket and the schedule of confidential filings, sealed exhibits include the financing-source disclosure for TTAM’s backer, certain customer-data-handling exhibits to the asset purchase agreement, and personnel-related schedules (Kroll restructuring portal).

TTAM Research Institute

Legal name and form. “TTAM Research Institute, A Nonprofit Public Benefit Corporation” — a California nonprofit public benefit corporation formed in 2025 specifically for the acquisition, named to evoke the original company name. (“TTAM” is widely reported as standing for “Twenty-Three and Me,” 23andMe itself being a reference to the 23 pairs of human chromosomes.) (23andMe closing release, 2025-07-14; TechCrunch).

Wojcicki’s role. Founder and, per TTAM’s own communications, lead of the institute. As stated in her own X post and TTAM’s press release: “TTAM Research Institute (TTAM), a new non-profit medical research organization that I founded and lead, has completed the acquisition of 23andMe.” Wojcicki’s direct X post returned an HTTP 402 (paywalled API) at fetch; the statement is carried upstream by CNN Business and TechCrunch (Wojcicki’s X post, 2025-07-14; CNN Business; TechCrunch).

Governance. The bylaws and current board roster are not in the press file; TTAM has pointed external readers to its governance page. As of this writing the public record does not yet contain the IRS Form 1023 application, a full board roster, audited financials, or the donor-advised-fund structure. These are open items for FOIA and IRS Form 990 pulls once the first fiscal year closes.

Privacy commitments embedded in the sale order. TTAM agreed, in the asset purchase agreement and in court representations, to a binding restriction on selling or transferring genetic data in any future bankruptcy; establishment of a privacy advisory board; two business days’ advance notice to customers before material privacy-policy changes; and perpetual customer rights to data deletion and to opt out of research participation (Elevenflo summary citing the asset purchase agreement and sale order; Quinn Emanuel firm note on the auction win).

The structural observation. Approximately 15 million genotype records, collected over 19 years (2006–2025) by a publicly traded for-profit corporation under one set of consumer terms, were transferred — through a court-supervised sale rather than through individual re-consent — to a newly formed nonprofit controlled by the same founder. Wojcicki had been trying to take 23andMe private since at least April 2024; the independent board refused her offers (the September 2024 mass resignation was over this); and Chapter 11 produced an outcome materially equivalent to taking the company private, on her terms, at a fraction of the prior equity valuation. Without endorsing any motive, the receipt-level fact pattern is that the bankruptcy made possible what the public-company governance process had blocked — a structural observation grounded in the sourced facts above, not a claim of bad-faith motive. Where commentators have made the same observation, it has been attributed to them (see the Lawfare analysis below).

Multistate attorney-general response

The coalition. A bipartisan coalition of 28 state attorneys general filed a complaint and a separate objection to the bankruptcy sale on 2025-06-09 in the Eastern District of Missouri bankruptcy court. The states argued that consumer genetic information — including biological samples, DNA data, health-related traits, and medical records — could not be transferred without each individual customer’s informed consent under various state genetic-privacy acts, and that the bankruptcy sale procedures themselves were facially inadequate. These are the states’ filed allegations, which the court ultimately rejected.

Roster (filed 2025-06-09): Arizona, Colorado, Connecticut, District of Columbia, Florida, Illinois, Kansas, Kentucky, Louisiana, Maine, Michigan, Minnesota, Missouri, New Hampshire, New Mexico, New York, North Carolina, Oklahoma, Oregon, Pennsylvania, South Carolina, South Dakota, Utah, Vermont, Virginia, Washington, West Virginia, Wisconsin. New York AG Letitia James led the coalition complaint (NY AG press release; Connecticut AG; Michigan AG; Oregon DOJ; Colorado AG; North Carolina AG; Pennsylvania AG).

Texas. Texas (Paxton) joined the multistate coalition and was among the five states that did not settle out before the sale order (CNN).

California — earliest and most pointed. California AG Rob Bonta issued an urgent consumer alert on 2025-03-21, two days before the bankruptcy filing. Whether that timing reflects the state’s watching of the public-company filings or independent intelligence of the impending Chapter 11 is an open question, not a sourced claim of a leak. The alert directed Californians to exercise specific GIPA and CCPA rights. Bonta’s office subsequently opposed the TTAM sale on the ground that it “does not comply with [the Genetic Information Privacy Act]” because GIPA requires affirmative opt-in consent for third-party sales of genetic information, and released a post-ruling statement: “23andMe’s proposed bankruptcy sale of vast amounts of genetic data and biological samples to TTAM — or potentially other purchasers — does not comply with GIPA and [we] are disappointed in the court green lighting the sale despite our objection.” (AG Bonta consumer alert, 2025-03-21; Yahoo News carrying Bonta’s post-ruling statement; Public Citizen petition urging a California AG investigation).

The rights Bonta’s office cited under GIPA (Cal. Civ. Code §§ 56.18–56.186): delete account and genetic data; require destruction of biological samples; revoke consent for genetic data collection, use, and disclosure; withdraw authorization for sample storage after initial testing. Under CCPA: the right to delete personal information.

New York. AG Letitia James led the complaint and, earlier (March 2025), issued a consumer alert urging New Yorkers to contact 23andMe to delete their data (NY AG press release on suit).

Final state opposition. After the multistate complaint, most coalition states withdrew their objection following negotiation of the privacy-protection conditions in the TTAM asset purchase agreement. Five states held opposition through the sale hearing: California, Kentucky, Tennessee, Texas, and Utah. Judge Walsh’s 2025-06-27 sale order dismissed those remaining objections on the theory that GIPA’s “third-party sale” trigger did not apply because TTAM committed to maintain the data privately (MobiHealthNews).

Senate and federal response

Senate Judiciary Committee hearing. Wednesday, 2025-06-11, Dirksen Senate Office Building Room 226. Title: 23 and You: The Privacy and National Security Implications of the 23andMe Bankruptcy. Chair: Sen. Charles Grassley (R-IA); Ranking: Sen. Richard Durbin (D-IL). Witnesses: Joseph Selsavage (Interim CEO and CFO, 23andMe); I. Glenn Cohen (Deputy Dean and Professor, Harvard Law School); Brook Gotberg (Professor of Law, BYU Law School); and Adam Klein (Director, Robert S. Strauss Center for International Security and Law, UT Austin) (Senate Judiciary hearing page).

Grassley opening statement (verbatim excerpts). Grassley framed the hearing in explicit national-security terms — “23andMe collected genetic data from roughly 15 million people”; “Genetic data is a particularly potent weapon”; “There is no data privacy law that protects genomic data”; “The threat from China is particularly acute” — referencing China’s “military-civil fusion strategy” and a recent federal criminal case involving two Chinese nationals charged with smuggling “a dangerous pathogen” into the United States, and co-sponsoring Senator Cornyn’s “Don’t Sell My DNA Act.” This national-security framing is Grassley’s own, quoted as his (Grassley opening remarks).

Hawley moment. Sen. Josh Hawley (R-MO) addressed Selsavage with the line — captured on CBS News footage and widely circulated — that he hoped 23andMe customers “will rush to the courthouse…to sue you into oblivion.” The line is quoted as Hawley’s statement, not endorsed (CBS News video clip; Newsweek).

Klobuchar position. Sen. Amy Klobuchar (D-MN) participated and is a co-sponsor of the bipartisan Cornyn / Grassley / Klobuchar bill (Klobuchar press release).

House Oversight hearing. Tuesday, 2025-06-10 (one day before the Senate Judiciary hearing). Full Committee on Oversight and Government Reform, Chair Rep. James Comer (R-KY). Witnesses included Anne Wojcicki (Founder and Board Member, 23andMe) and Joseph Selsavage. At this hearing Selsavage stated on the record: “We are committed [to not selling sensitive data to foreign adversaries]”; “as part of the bankruptcy process, we have committed under no circumstances will we sell this sensitive data to foreign adversaries such as China, Russia, or North Korea”; and “Since we announced bankruptcy, we’ve had 1.9 million customers call and request that we delete their data, and we have done so within a reasonable timeframe” — approximately 15% of the customer base, on his own arithmetic (Comer announcement of hearing; Comer opening statement; Wojcicki witness bio; Library of Congress event record; Malwarebytes coverage).

Senator letters on national security. Sens. Mark Warner (D-VA) and Todd Young (R-IN) wrote to DOJ and FTC in April 2025 urging full use of all authorities — including CFIUS — to protect Americans’ genomic data in the bankruptcy proceeding (Warner press release; Young press release).

DOJ filing in the bankruptcy. In April 2025 (2025-04-17 per the Lawfare account; 2025-04-22 per Warner’s commendation), the United States filed a notice in the 23andMe bankruptcy informing the court that the debtor’s potential transactions might be subject to review by CFIUS and might be prohibited or restricted by the DOJ National Security Division’s Data Security Program (the program under 28 CFR Part 202, implementing EO 14117 of February 2024) — the direct CFIUS / 28 CFR § 202 hook in the docket (United States’ Notice Regarding Potential National Security Concerns — Scribd mirror; Lawfare analysis; eCFR 28 CFR Part 202).

The CFIUS doctrinal hook. CFIUS’s jurisdiction over “sensitive personal data” was codified in 31 CFR § 800.241 under FIRRMA (2018), and DOJ’s 28 CFR Part 202 implements EO 14117 (signed February 2024) restricting transfers of bulk sensitive personal data — explicitly including human genomic data — to “countries of concern” and “covered persons.” The Lawfare commentary by J.B. Branch notes that because the winning bidder, TTAM, is US-based and Wojcicki-controlled, the “foreign adversary” CFIUS trigger does not cleanly apply; a hypothetical Chinese-controlled bidder would have produced a much sharper CFIUS posture (Lawfare; Treasury sensitive-personal-data definition, 31 CFR § 800.241).

Legislation. The Don’t Sell My DNA Act was introduced in May 2025 by Sens. John Cornyn (R-TX), Charles Grassley (R-IA), and Amy Klobuchar (D-MN). It adds “genetic information” to the definition of “personally identifiable information” in the Bankruptcy Code (11 U.S.C. § 101(41A)), so that bankruptcy-court protections on PII apply going forward (Senate Judiciary release on the bill; Cornyn press release).

Klein testimony (UT Austin). Adam Klein’s prepared statement frames genetic data as revealing population-level characteristics relevant to adversary intelligence and recommends that Congress establish clearer legal authority for reviewing foreign access to genetic databases beyond the equity-investment frame, strengthen data-protection standards for genetic information held by private companies, and impose transparency requirements on foreign partnerships in genetic research (Klein prepared testimony PDF).

The data — genomes in, deletions out, what TTAM now holds

Inputs. Approximately 15 million customer profiles entered the bankruptcy estate. This is the company’s own number, repeated in the state-AG complaint, the Grassley opening statement, and the Selsavage testimony.

Breach exposure (2023). Approximately 6.9 million users (roughly half the customer base) had data accessed during the 2023 credential-stuffing campaign: 14,000 accounts directly compromised, 5.5 million additional users exposed via DNA Relatives scraping, and an additional ~1.4 million via Family Tree (23andMe SEC EDGAR filings).

Pre-bankruptcy opt-out architecture. 23andMe’s consumer terms always provided account-deletion and sample-destruction options. Operational practice, however, did not require two-factor authentication at the time of the breach and did not flag sustained large-scale login attempts as suspicious — a characterization attributed to the peer-reviewed forensic post-mortem, not asserted here as an independent finding of negligence (Pan et al., arXiv 2025).

Post-petition deletions. Approximately 1.9 million customers requested deletion in the period from the 2025-03-23 filing through the 2025-06-10 House Oversight hearing — approximately 15% of the customer base on Selsavage’s own arithmetic (Selsavage House Oversight testimony; Slashdot citing Reuters).

What TTAM holds after closing (2025-07-14). Roughly 13.1 million customer genotype profiles — 15 million minus 1.9 million deletions, rough arithmetic, since the company has not published the exact post-closing number — plus biological samples (saliva tubes in long-term storage) for those subscribers who consented to sample retention. The Personal Genome Service and Research Services product lines continue to operate (TTAM closing press release).

Continuing customer rights. Per the asset purchase agreement and the TTAM commitments embedded in the sale order: a perpetual right to delete account and genetic data, to opt out of research participation at any time, and to revoke sample-storage authorization. Whether these contractual commitments survive a second future restructuring is the unsettled question — the legislative response is precisely that the Bankruptcy Code does not currently treat genetic data as PII.

The Wojcicki public record (quotes with sourcing)

This section quotes Anne Wojcicki’s public statements as carried by named third-party publications. Her direct X-platform statement is cited via CNN and TechCrunch because the X post itself returned an HTTP 402 (paywalled API) at fetch.

On founding intent. Wojcicki has long framed 23andMe as a project to democratize access to one’s own genome. The Sequoia profile (May 2021) emphasizes her “build the business of bloodlines” framing, quoted from that profile (Sequoia profile).

On the September 2024 board resignations. An internal memo to employees stated she was “surprised and disappointed” by the directors’ decision and remained “committed to taking the company private” (CNBC, full memo text).

On the bankruptcy filing. Wojcicki resigned as CEO on the petition date, 2025-03-23, and stated she would pursue the company as an independent bidder (23andMe Chapter 11 press release).

On the TTAM acquisition (own statement, X, 2025-07-14). As quoted upstream by CNN and TechCrunch: “To the 23andMe Community, I am incredibly excited and humbled to share with you that TTAM Research Institute (TTAM), a new non-profit medical research organization that I founded and lead, has completed the acquisition of 23andMe.” (CNN Business; TechCrunch).

On TTAM’s mission. TTAM’s mission language as carried in the closing press release: “dedicated to helping scientists and non-scientists join together to unravel the mysteries of DNA — the code of life … everyone should have the opportunity to access their individual genetic code and be empowered to contribute it to scientific research.” (TTAM closing press release).

On the customer-trust posture (House Oversight, 2025-06-10). Wojcicki testified alongside Selsavage at the House Oversight hearing; the witness bio confirms her appearance (Wojcicki witness bio at Congress.gov).

The full transcripts of both the House Oversight and Senate Judiciary hearings are not yet posted in single-document form on Congress.gov; the witness-testimony PDFs for the Senate Judiciary hearing (Cohen, Gotberg, Klein) are available individually.

Precedent — comparable genetic-data-company governance events

This is the “and it’s not just 23andMe” leg. Each company is a documented governance event with a different failure mode; the pattern-level characterization at the end is an observation about the industry, not an accusation against any single firm.

Ancestry.com — private-equity ownership. Acquired by The Blackstone Group in December 2020 for $4.7 billion. Blackstone’s holdings include Ancestry’s database of approximately 18 million tested individuals as of acquisition (now reportedly more than 25 million). Ancestry has consistently stated it does not permit law-enforcement uploads of unknown DNA profiles to its database — a different policy from GEDmatch. The relevant point is that the database is now under private-equity ownership with a finite hold period, so ordinary PE exit-liquidity expectations apply at the back end (CBS News; Wikipedia — Ancestry.com).

GEDmatch → Verogen → Qiagen. GEDmatch was the upload portal used in 2018 to identify Joseph James DeAngelo (the Golden State Killer) via third-cousin match. In December 2019, GEDmatch was sold for approximately $15 million to Verogen, Inc., a company purpose-built to market sequencing technology to crime labs — the database acquired by a law-enforcement-focused company. Verogen was subsequently acquired by Qiagen in 2023. The EFF documented the customer-base reaction in real time: most users had not been informed of the law-enforcement upload pathway before the change, and GEDmatch’s terms had to be revised mid-transaction (EFF analysis; Slate).

MyHeritage — PE-owned, Israeli-based genealogy database. Founded in Israel in 2003 by Gilad Japhet; launched MyHeritage DNA in 2016. Acquired by Francisco Partners (a US PE firm) in early 2021 for approximately $600 million, with approximately 6.5 million DNA kits in the database as of March 2023. The company maintains a stated policy of refusing law-enforcement uploads absent a court order or subpoena. The 2018 MyHeritage breach (92 million email addresses plus hashed passwords; per company disclosure, no DNA data accessed) is a documented prior breach event (Wikipedia — MyHeritage; terms.law privacy summary).

Helix — pivoted away from DTC after the Illumina exit. Founded in 2015 with Illumina backing. After Illumina ended the partnership in April 2019, Helix shifted away from consumer apps toward “population genomics” partnerships with health systems and payers, with layoffs and the closure of its Denver and San Francisco offices. Consumers signed up for consumer apps; the data now flows through enterprise-partner channels — a documented prior governance shift (GenomeWeb).

Color Genomics → Color Health. Founded in 2014 as Color Genomics (Burlingame, CA); rebranded as Color Health and pivoted from BRCA-focused DTC testing to enterprise cancer-care delivery — the same direction of travel as Helix, a DTC genetics company surviving by becoming a B2B health-services vendor (Wikipedia — Color Genomics).

Othram, Parabon NanoLabs. Forensic-genetic-genealogy service vendors that sit downstream of the consumer databases. Per a Forensic Magazine compilation (as of December 2023), forensic genetic genealogy had resolved 651 cases including 318 identified perpetrators; Othram disclosed 250+ cases as of 2024 per company press. These are the use layer that monetizes the consumer-database substrate (Othram; Parabon NanoLabs; Murphy & Tong, Science 384, 38–40 (2024)).

The composite pattern. Across these examples — Blackstone holding Ancestry, Verogen acquiring GEDmatch, Francisco Partners holding MyHeritage, Helix pivoting to B2B, Color rebranding to oncology services, and the Othram/Parabon law-enforcement use layer — the consumer-genetics industry’s governance trajectory is monotonic: consumer databases collected under one consent regime are routinely re-housed under different governance (private-equity, law-enforcement-aligned, enterprise-services, or — as with 23andMe — bankruptcy-reorganized nonprofit) without individualized re-consent. 23andMe / TTAM is the first time this happened via Chapter 11 of a publicly traded entity, and the first time it triggered a coordinated 28-state AG response and a sitting Senate hearing. The pattern is older; the precedent is new.

Open questions

These are documented gaps, not claims — nothing below is asserted as fact.

Verdict

The 23andMe → TTAM story is documented end-to-end at the receipt level: a publicly traded genetic-data company holding approximately 15 million profiles filed Chapter 11 (25-40976, E.D. Mo., Judge Walsh), and, after an open auction, transferred those records — via court-supervised sale rather than individual re-consent — to TTAM Research Institute, a nonprofit founded and led by co-founder Anne Wojcicki, for $305 million. Every dated event, dollar figure, quote, and legal ruling carries a primary source (bankruptcy docket via Kroll, SEC 8-K, FDA archive, Congress.gov hearing records, state-AG press releases) or a named publication.

What is solid: the full corporate timeline, the breach numbers, the bankruptcy chronology and sale outcome, the 28-state AG roster, the Senate and House hearings and verbatim quotes, the CFIUS / 28 CFR § 202 statutory hooks, and the precedent companies’ ownership histories.

What is attributed and must stay attributed: the structural observation that the bankruptcy achieved what the public-company process had blocked (a grounded inference, never a bad-faith-motive claim); the “did California have advance notice” thread (an open question, never a leak claim); all national-security framing (Grassley’s, quoted as his); the AGs’ GIPA-violation allegations (their filed allegations, which the court rejected); and the DIP terms and Ombudsman detail resting on a secondary summary. No group is characterized as having committed a crime, breached a fiduciary duty, or acted in bad faith.

The load-bearing point for the body layer: approximately 15 million genotype records changed governance regime without any individual customer being asked to re-consent, and the mechanism was the ordinary machinery of Chapter 11. Speech is corrigible; a genome is not, and you cannot leave your own body.

Get updates on the Evil Robots series

Newsletter essays on AI escape, deception, and the humans who built them.