Is 23andMe Safe After the Bankruptcy and Sale? What Customers Need to Know

For years, 23andMe was one of the best-known names in consumer DNA testing. Then, in the space of a few years, it went through a major data breach, a collapse in its share price, a bankruptcy filing and a sale. If you've tested with 23andMe, or you're considering it, you're right to ask whether your genetic data is safe.

This guide explains what happened in plain English, what the sale means for customers, and exactly what you can do to protect, download or delete your data. We'll also cover whether we'd recommend buying a 23andMe kit today.

What happened to 23andMe?

The 2023 data breach

In 2023, attackers gained access to a number of 23andMe customer accounts, largely by using passwords that people had reused from other websites that had previously been breached. This technique is known as "credential stuffing". Because of 23andMe's relative-matching features, the attackers were then able to view information about many more customers who were connected to those accounts as DNA relatives.

In total, information relating to roughly 7 million customers was affected. The exposed data included profile information such as names, ancestry reports and relative-matching details. 23andMe said raw genetic data files were not accessed, but the breach seriously damaged trust in the company. It faced lawsuits and regulatory action, including a fine from the UK's privacy regulator, the Information Commissioner's Office.

The 2025 bankruptcy

The company had been struggling financially for some time. In March 2025, 23andMe filed for Chapter 11 bankruptcy protection in the United States, and co-founder Anne Wojcicki stepped down as chief executive. The filing set off a court-supervised process to sell the business, which, crucially, included its database of customers' genetic information.

That raised an alarming question for millions of people: who would end up owning their DNA data? Several US state attorneys general urged customers to consider deleting their data, and many did.

The sale to TTAM Research Institute

After an auction in which the pharmaceutical company Regeneron initially emerged as the winning bidder, a nonprofit called TTAM Research Institute, founded and led by Anne Wojcicki, submitted a higher offer of about US$305 million and won. The bankruptcy court approved the sale, and it was completed in July 2025.

TTAM has said it will continue to operate 23andMe's services, honour customers' existing privacy choices, give customers transparency about how their data is used, and set up an independent privacy advisory board. Customers were notified of the change of ownership and given the option to delete their data.

So, is your data safe now?

The honest answer is: it depends on what you mean by "safe", and how much risk you're comfortable with.

What's reassuring

• The buyer is a nonprofit research institute led by the company's co-founder, rather than an unknown third party.
• TTAM committed to honouring customers' existing consent choices, including whether your data is used in research.
• You retain the ability to download your data and to delete your account.
• Security practices were tightened after the 2023 breach, including mandatory two-step verification for accounts.

What's worth considering

• Your genetic data has now changed hands once. Commentators have pointed out that the sale agreement doesn't guarantee it will never be transferred again in future.
• In the US, consumer genetic testing services generally aren't covered by the health privacy law HIPAA. Protection depends on the company's own policies and a patchwork of state laws. Australian and UK privacy laws apply differently, but enforcement against an overseas company can be harder.
• Unlike a password, your DNA can't be changed if it's ever exposed. It also contains information about your relatives, who haven't consented.

None of this means you must delete your account. Many customers value their health reports and relative matches and are comfortable continuing. But it's a decision worth making deliberately, rather than by default.

Your options as a 23andMe customer

Option 1: Stay, but tighten your settings

If you'd like to keep using 23andMe, take ten minutes to review your account:

1. Change your password to a long, unique one that you don't use anywhere else. A password manager makes this easy.
2. Confirm two-step verification is on.
3. Review your research consent. In your account settings you can see whether you've agreed to take part in research, and withdraw consent if you prefer.
4. Review relative-matching visibility. You can choose how much of your profile matches can see, or opt out of matching entirely.
5. Decide about sample storage. If you previously agreed to have your saliva sample stored, you can request that it be discarded.

Option 2: Download your data, then decide

Whatever you choose, we strongly recommend downloading your raw data and any reports you value. This gives you a personal copy that no company controls, and it lets you upload your DNA to other genealogy services, so you keep the family history benefits even if you later delete your 23andMe account.

To download your data, sign in and look for the option to access your raw data in your account or settings area. The download can take a little while to prepare, and you'll usually receive an email when it's ready. Store the file somewhere secure, ideally encrypted.

Option 3: Delete your account and data

If you've decided you no longer want 23andMe to hold your genetic information, you can request permanent deletion from your account settings. Deletion is generally irreversible, so download anything you want to keep first.

A few things to know about deletion:

• Deleting your account removes your data from the service, but companies may retain some information where they say they're legally required to, for example for laboratory compliance.
• Data that has already been used in research studies may not be withdrawn from studies that have already been completed.
• Your relative matches will no longer see you, and you'll lose access to your reports.

Check the current wording of the company's privacy statement for full details, as policies can change.

Keeping the genealogy benefits elsewhere

Many people tested with 23andMe primarily for ancestry and relative matching. If you're leaving, you don't have to lose that. After downloading your raw data, you can upload it to services that accept transfers.

• MyHeritage accepts uploads from most major testing companies and has a large international database.
• Other services, such as FamilyTreeDNA and GEDmatch, also accept uploads, each with their own privacy policies and settings.

Before uploading anywhere, read that company's privacy terms and choose your matching and research settings carefully. Be particularly aware of whether a service allows law enforcement matching, and whether you've opted in or out.

Should you buy a 23andMe kit today?

23andMe still offers features that its competitors don't match in the same way, especially its health predisposition, carrier status and wellness reports in its health tier, along with a polished app and detailed haplogroup information.

If health insights are your priority and you're comfortable with the company's ownership history and current terms, it remains a reasonable choice. Read the privacy statement carefully, decide your research and matching settings before your results arrive, and use a strong unique password.

If your goal is family history, finding relatives and building a family tree, we generally recommend AncestryDNA instead. Its database is much larger, independent estimates in early 2026 put it at around 30 million kits, so you'll find far more relatives. That's a bigger practical benefit for genealogy than anything 23andMe offers.

⚖️ Compare AncestryDNA vs 23andMe side by side →

Understanding the real risks of DNA data

It's easy to feel either complacent or alarmed about genetic privacy. A clearer picture of the actual risks helps you make a sensible choice.

Account takeover

The 2023 breach shows the most common real-world risk: someone logging into your account with a reused password. This is also the risk you have the most control over. A unique password and two-step verification block the overwhelming majority of these attacks.

Data shared through matching

When you opt into relative matching, other customers can see some of your details, and so could anyone who gains access to one of their accounts. If that concerns you, you can limit what your profile displays, or opt out of matching altogether while keeping your reports.

Future changes of ownership

Any company can be sold or go out of business. Your protection here comes from the company's terms, the laws where you live, and, ultimately, from whether you choose to keep your data with them.

Effects on relatives

Because you share DNA with your family, your data says something about them too. That's a good reason to talk with close relatives about testing, and to treat surprising results, such as unexpected relatives, with care.

Keeping these risks in proportion matters. For most people, a strong password, sensible matching settings and a clear view on research consent address the practical concerns. The decision to stay or leave is then about how comfortable you are with the company itself.

Questions to ask any DNA testing company

The 23andMe story is a useful reminder to ask the same questions of every DNA company, whichever you choose:

• Who owns the company, and what happens to my data if it is sold or goes out of business?
• Is my data used for research? Can I opt out, and can I change my mind later?
• Do you share data with third parties, including pharmaceutical partners?
• What is your policy on law enforcement requests?
• Can I download my raw data?
• How do I delete my account, data and physical sample?
• Do you offer two-factor authentication?

Our full DNA kit reviews include a privacy assessment for each company, and privacy accounts for a fifth of every score in our review methodology.

The bottom line

23andMe's bankruptcy and sale were a wake-up call for the whole consumer DNA industry. Under its new nonprofit owner, the service continues, and customers retain meaningful control over their data. Whether that's "safe enough" is a personal decision.

Whatever you decide, the most important steps are the same: use a strong unique password with two-step verification, review your consent settings, and download your raw data so you always have your own copy.

Frequently asked questions

Who owns 23andMe now?

Since July 2025, 23andMe's business has been owned by TTAM Research Institute, a nonprofit founded and led by 23andMe co-founder Anne Wojcicki.

Was my DNA stolen in the 2023 breach?

23andMe said the attackers accessed profile and relative-matching information, not raw genetic data files. If you were affected you should have been notified by the company.

If I delete my 23andMe account, can I still find relatives?

Yes, if you download your raw data first and upload it to another service that accepts transfers, such as MyHeritage.

Does deleting my account destroy my saliva sample?

You can request that any stored sample be discarded. Check your account settings and the current privacy statement for how this works.

This article is general information, not legal advice. Company policies change, so always check the latest terms directly with the company.