The genetic testing company 23andMe, once valued at $6 billion, is facing an uncertain future after a drop in share prices, a recent board resignation and a data breach last year that affected nearly 7 million customers.
The turmoil has raised questions about what might happen to the genetic data of the company’s roughly 15 million customers.
Last month, the seven independent directors of the board sent an open letter to Anne Wojcicki, the CEO and co-founder of 23andMe, notifying her of their resignation while citing frustration with the company’s direction.
“After months of work, we have yet to receive from you a fully financed, fully diligenced, actionable proposal that is in the best interests of the nonaffiliated shareholders,” the letter said.
Soon after, Wojcicki, who owns 49% of the voting stock, said in a federal filing that she was determined to take the company private.
The company has said that it is committed to customer privacy, but people who have submitted tests to discover ancestry lines or for health care research can potentially leave their information vulnerable to threat actors.
Customers provide the company with a saliva sample for analysis of ancestry, family traits and potential health risks. Some 80% of people also agree to have their genetic data used for research on diseases, such as Parkinson’s and lupus, according to 23andMe.
“People don’t, I think, appreciate how large the genetic information for a person is,” Mark Gerstein, a professor of biomedical informatics at Yale University, said Saturday.
“In theory, if there’s a mess-up with your credit card or Social Security number, you get a new one; it can be fixed,” Gerstein said. “But there’s absolutely no way to get a new genome.”
If a threat actor was able to access a genome, which contains DNA information, one of the biggest concerns is that someone’s medical characteristics and potential for health risks, he said, like psychosis or heart disease, could be revealed.
Although a genome does not change, the technology that is able to analyze it continues to advance and more precisely interpret the material.
Andy Kill, a company spokesperson, on Saturday said the company adheres to the rules regarding the data that it gains.
“We follow laws that regulate the data we collect and believe strongly that customers should have the choice and ability to decide how their data is used,” he said. “Nothing about that commitment has changed.”
After 23andMe went public in 2021, its value briefly topped $6 billion, but today its shares are worth less than $1 each. In a statement released in August, the company said that its revenue for the first quarter of the 2025 fiscal year totaled $40 million, about 34% less than the same period the year before.
Part of the drop in earnings was attributed to fewer test kits being ordered, which comes on the heels of a data breach last year that targeted Jewish and Chinese customers, according to a class-action lawsuit.
In December 2023, hackers were able to gain access to the personal information of nearly 7 million profiles by recycling old passwords that 23andMe customers had used on other sites that had been compromised. The company said in a statement that month that it was taking steps to further protect data.
“23andMe, in addition to our own strict privacy and security protocols, is subject to state and federal laws that require similar or more protective privacy and security program requirements than HIPAA,” Kill said, referring to the Health Insurance Portability and Accountability Act.
Although some laws are enforced by individual states, Kill said that “23andMe took additional steps to apply them to all 23andMe customers globally.”
Genome structures are complex, and the path to unearthing sensitive information from them is far from simple. But it’s hard to tell what might be accessible to someone with the right tools.
Looking at a genome can reveal a complicated structure, akin to ones and zeros of binary code, Gerstein said. That might make it seem like the information is harder to glean than from a personal tech device.
“Superficially, there might be a comforting aspect to that, as opposed to if I peek in your email box,” he said. However complex the genome is, though, it can still hold sensitive private data.
“In the longer term, maybe it actually is more revealing,” he said.
This article originally appeared in The New York Times.
© 2024 The New York Times Company