You spat in a tube to find out if you were part Viking. A few weeks later an email told you about a second cousin you never knew, a slightly elevated risk of a disease you couldn’t pronounce, and a sliver of Neanderthal. It felt like magic, and it cost about a hundred dollars, once.
That “once” is the whole story. In March 2025, 23andMe filed for bankruptcy, and the most valuable thing it owned was not a lab or a patent. It was you: the genetic code of more than 15 million people, boxed up as an asset and sold to the highest bidder. Here is how the company that mapped your ancestry ended up auctioning your DNA, and who holds it now.
Key Takeaways
- 23andMe filed for Chapter 11 bankruptcy in March 2025, after a 2021 stock market debut that once valued it near $6 billion collapsed to near-zero.
- The core asset was the DNA of more than 15 million customers. In a bankruptcy, that database became property to be sold, which is exactly what alarmed regulators.
- A 2023 data breach was the warning shot: hackers cracked about 14,000 accounts that had no two-factor authentication, then scraped relatives’ profiles to expose data on 6.9 million people.
- Two bidders fought over your genes. Drugmaker Regeneron won a first auction at $256 million; after 28 state attorneys general sued, the auction reopened and co-founder Anne Wojcicki’s nonprofit won at $305 million.
- The business never had a second act. A DNA test is a one-time purchase, and the pharma-data goldmine 23andMe promised investors never arrived.
Why Did 23andMe Go Bankrupt?
23andMe went bankrupt because it sold a product you only ever needed to buy once, and the far more valuable business it promised, turning genetic data into blockbuster drugs, never materialized. It was a company with 15 million customers and almost no repeat customers.
The rise was real. Founded in 2006, 23andMe made spit-in-a-tube genetics a cultural phenomenon, went public in 2021 through a SPAC merger backed by Richard Branson, and briefly carried a valuation near $6 billion. Its pitch to Wall Street was never really the $99 ancestry kit. It was the database: build the largest private library of human DNA on Earth, then license and mine it to discover drugs worth billions. In 2018, GlaxoSmithKline paid $300 million for exactly that kind of access.
But the ancestry novelty wore off. Most people take the test once. They learn they are 12 percent Scandinavian, and never pay the company another cent. Revenue stalled. The drug-discovery arm burned cash without producing a marketed hit, and the stock slid so far it faced delisting. By the time the board and Anne Wojcicki fell into open conflict in 2024, with the entire independent board resigning en masse that September, the company was running out of road. This is the quiet way empires end, the same slow bleed that runs through the corporate collapse files: not a single catastrophe, but a business model that only worked once.
What Happens to Your DNA When a Company Goes Bankrupt?
It gets treated as an asset and sold with everything else, which is precisely the problem: your genome is not like a warehouse or a trademark, but bankruptcy law mostly treats it that way. When 23andMe filed, the DNA of 15 million people effectively went on the auction block.
The reaction was immediate and bipartisan. Attorneys general across the country urged customers to delete their data. California’s told residents to invoke their genetic privacy rights. This worry was not hypothetical: genetic data can expose disease risk, family relationships, and ancestry, it cannot be changed like a password, and it implicates relatives who never signed up for anything.
Then came the bidding war over the database.
| Stage | Buyer | Amount | What happened |
|---|---|---|---|
| First auction, May 2025 | Regeneron Pharmaceuticals | $256 million | Won the initial auction; pledged to honor privacy policies |
| Legal challenge, June 2025 | 28 state attorneys general | n/a | Sued to block the sale of genetic data, forcing a reopen |
| Final auction, June 2025 | TTAM Research Institute | $305 million | Anne Wojcicki’s nonprofit outbid Regeneron |
| Sale approved | TTAM Research Institute | $305 million | Judge OKs the sale; closes around July 8, 2025 |
TTAM, an acronym for “Twenty-Three And Me,” is a nonprofit Wojcicki set up in May 2025 specifically to buy the company back. It acquired the Personal Genome Service, the research business, and the Lemonaid Health telehealth arm, and pledged to adopt extra privacy safeguards and keep letting customers delete their data. Roughly 80 percent of 23andMe’s customers had already consented to their data being used for research. The genes stayed in a nonprofit’s hands rather than a drugmaker’s, but the deeper point stood: your DNA had a price, and it was set in a courtroom.
Was Your 23andMe Data Ever Safe?
Not as safe as 15 million people assumed, and the proof arrived two years before the bankruptcy. In October 2023, 23andMe disclosed a breach in which attackers used credential stuffing, logging in with passwords leaked from other sites, to break into about 14,000 accounts. Because 23andMe did not require two-factor authentication and allowed weak eight-character passwords, those 14,000 doors were enough. Once inside, the attackers scraped the “DNA Relatives” feature to pull data on 6.9 million people who were never directly hacked at all.
It is the same brutally simple attack that keeps winning across every industry: not genius code, but a login someone left unguarded. It is how one phone call shut down MGM’s casinos, and it is the human weak point at the center of nearly every story in our hacks archive. For the most sensitive data a person can hand over, 23andMe secured it like a shopping account. 23andMe later agreed to a $30 million settlement, given final court approval in January 2026 and proposed to rise to $50 million after the bankruptcy.
The breach was a preview of the deeper truth: a company that collects the genome of millions is a permanent target and a permanent liability, whether the threat is a hacker or a bankruptcy judge. That tension, between a business that treats your data as its product and your own interest in that data, is the through-line of the biggest Big Tech investigations, from Cambridge Analytica harvesting 87 million Facebook profiles to this.
The Critical Choice
23andMe’s fatal decision was made at the very beginning, in how it defined the business: the real product was never the test, it was the database. The company sold cheap kits at little or no profit to amass the largest private genetic library in the world, betting that this trove would one day be worth billions to pharmaceutical partners. That bet shaped everything. It justified collecting 15 million irreplaceable genomes, it justified treating the ancestry kit as a loss leader, and it meant that when the drug-discovery jackpot never came and test sales dried up, the only asset with any value left to sell was the DNA itself. A company built to monetize your genome will, when it fails, monetize your genome. That 2023 breach simply showed how lightly that priceless asset was guarded along the way. The alternative, a durable business with recurring revenue and data treated as a sacred trust rather than inventory, was never the plan, and the bankruptcy auction was the plan’s logical end.
Where Things Stand Now
As of mid-2026, 23andMe operates under TTAM Research Institute, the nonprofit run by Anne Wojcicki, which now stewards the genetic data of more than 15 million people and says it will honor the old privacy commitments and deletion rights. The class-action breach settlement is finalized. Regulators are still debating whether genetic data should ever be sellable in a bankruptcy at all, a question 23andMe forced onto the national agenda the hard way.
If you were ever a customer, the practical takeaway is simple: you can still log in, download your raw data, and delete your account and sample if you want them gone. The company that promised to reveal where you came from ended up revealing something colder, that in the end, the most personal data in the world is only ever as protected as the balance sheet holding it. This page will be updated as the privacy fights and any new ownership questions develop.
