BRANDFALLEN

Episode 1: 23andMe

How 23andMe Lost Everything

23andMe was once worth about $6 billion. In 2025, its business and the genetic data of about 15 million customers were sold in a bankruptcy court for $305 million. This is how it happened, and who ended up with the data.

Subscribe on YouTube

Chapters

The full story

In 2025, the genetic data of about 15 million people went up for sale in a bankruptcy court.

They were customers of 23andMe, the company that reads your DNA from a tube of spit. The drug giant Regeneron won the auction first, with 256 million dollars. Then the bidding reopened, and a nonprofit beat that offer by 49 million. It was led by Anne Wojcicki, who co-founded 23andMe in 2006.

At its peak, 23andMe had been worth about six billion dollars. The winning bid was 305 million. The shareholders' stock was cancelled.

So how does a six-billion-dollar company end up at auction, and how does it land with a nonprofit run by its own co-founder?

If you've ever mailed off one of those tubes, this story is partly about you. If a cousin did, it might be about you too. Half your genome came from your mother and half from your father, and you share long stretches of it with relatives you've never met. So when a company holding millions of those files runs out of money, who gets them?

It took a judge, more than two dozen states, a drug company and a founder's nonprofit about four months in 2025 to settle that. Working out who would pay for the mess took more than a year longer.

To see how it got there, go back to 2006. Three people founded 23andMe: Anne Wojcicki, Linda Avey and Paul Cusenza. The name comes from the 23 pairs of chromosomes in most human cells. The pitch was simple. Send in some saliva, and they'll tell you what's written in your DNA.

The money came from close to home. In May 2007, an SEC filing showed Google had invested 3.9 million dollars for a minority stake. Its co-founder, Sergey Brin, had already lent the company about 2.6 million, since repaid.

That same month, Brin and Wojcicki got married.

Cusenza left that year. In November 2007, the test launched in the US at 999 dollars. That's a lot of money for curiosity, and the press loved it anyway. In 2008, TIME named it Invention of the Year, and the price dropped to 399.

In June 2009, Google put in another 2.6 million. That year, Linda Avey stepped down as co-president, and in 2011 she left. From here on, this is Anne Wojcicki's company.

So what was 23andMe actually selling? Customers paid for a kit. The company was building a database. Every tube added one more genome, and a big enough collection of human DNA, linked to people's own answers about their health, could be worth far more than any number of kits.

Wojcicki went for scale. In January 2011, the company raised about 31 million dollars, with Johnson & Johnson's venture arm among the investors. In May 2012 the price fell to 299 dollars, and in December, to 99. A Series D of more than 50 million paid for the push. By then, 23andMe had about 180,000 customers.

A 99-dollar test that tells you about your health risks is an easy sell. It also raises an obvious question. Who decides whether those health claims are allowed?

In 2013, the answer arrived in a warning letter from the US Food and Drug Administration, telling 23andMe to stop marketing its health test.

Stop on that for a second. A federal regulator had told a young company to stop marketing its main product. That could have been the end.

Instead, 23andMe kept selling ancestry reports and kept working with the agency. In 2015, the FDA authorized its Bloom syndrome carrier report, which the company said was the first FDA authorization of a direct-to-consumer genetic test. It had found a way back, and its database kept growing.

Then the database paid off. In July 2018, GlaxoSmithKline invested 300 million dollars in a drug-discovery partnership built on the data of a company with more than five million customers. Those customers had paid 23andMe for their tests. Now a drug company was paying for what they'd sent in.

Here's what nobody tells you about selling DNA tests. Your genome doesn't change. Take the test once and you never need to take it again. Every customer buys one time, and then the company has to find a new one. So what happens when the new ones stop coming?

Demand started falling in 2019. In January 2020, 23andMe laid off about 100 people. The drug research would take years to pay off, and in December 2020, the company raised about 82.5 million dollars more.

Then came 2021, when money was cheap and going public was easy. In February, 23andMe agreed to merge with VG Acquisition Corp., a blank-check company backed by Richard Branson's Virgin Group. It went public at 11.13 dollars a share, and at its peak it was worth about six billion.

Look at what that number rested on. A product people buy once. A health test its regulator had once told it to stop marketing. And a database. Hold on to that last one, because in 2023 the database stopped being the reason to buy 23andMe and became the reason to fear it.

Around April 2023, hackers got in. Nobody at the company noticed for about five months. In October, 23andMe disclosed the breach. In December, it confirmed that data on about 6.9 million people had been accessed.

Here's the detail that matters. The hackers logged into only about 14,000 accounts, using passwords people had reused from other sites. So how do you get from 14,000 accounts to 6.9 million people?

You use the features the company built on purpose. A tool called DNA Relatives matched you with people who shared your DNA, like a social network inside the product. Through it, the hackers reached about 5.5 million people. Through a second feature, Family Tree, they reached another 1.4 million. The features that made 23andMe social were the ones that multiplied the damage.

According to the states that later investigated, 23andMe didn't require two-factor login and didn't do enough monitoring. A class-action lawsuit alleged that the hackers appeared to target people of Ashkenazi Jewish and Chinese ancestry. In September 2024, the company agreed to a preliminary 30-million-dollar settlement of that lawsuit.

Then came a letter.

On September 17, 2024, all seven of 23andMe's independent directors resigned together, in one letter addressed to Anne Wojcicki. Why would a whole slate of independent directors quit at once?

They said her plan to take the company private had not produced an offer they could act on. She said she was surprised and disappointed. She stayed on, and new directors were named. By June 2025 the board had a chairman, Mark Jensen. By then, 23andMe was in bankruptcy.

It had filed for Chapter 11 in the Eastern District of Missouri on March 23, 2025. In its own filing, the company pointed to the breach and the lawsuits that followed, along with competition and falling demand. The slump that began in 2019 had never gone away. The breach hit a company that was already weak.

The question from earlier wasn't hypothetical anymore. The genetic data of about 15 million customers was an asset in a bankruptcy sale, and customers were asking for their files to be deleted. Who would end up with the rest?

On May 19, 2025, Regeneron won the auction with 256 million dollars and promised to honor 23andMe's privacy policies. It looked settled.

It wasn't.

In early June, the bidding reopened. That month, 27 states and Washington, DC sued to stop the sale. On June 10, the interim CEO, Joseph Selsavage, went before the House Oversight Committee and said 1.9 million customers had asked for their data to be deleted.

Three days later, TTAM Research Institute announced it had won, at 305 million dollars, 49 million more than Regeneron. TTAM was a nonprofit led by Anne Wojcicki. The judge approved the sale in late June, and on July 14, 2025, TTAM completed the purchase.

That answers our first question. Wojcicki didn't buy 23andMe herself, and a nonprofit has no owners. Regeneron was outbid in a court-supervised auction, and a judge approved the result. Even so, the business she co-founded in 2006 now sat inside a nonprofit she led.

So who paid for the breach?

TTAM didn't take everything. What remained was a shell called Chrome Holding Co. Its liquidation plan took effect on December 5, 2025, and shareholders' stock was cancelled. In its place, they received interests in a trust, with an Equity Recovery Pool that pays out only after creditors are paid in full.

The breach bills went to Chrome. The class action settled for 46.75 million dollars. The states settled for 18 million, and California separately for about 6 million, with no admission of liability. In total, more than 70 million dollars came out of the bankrupt estate. The states' deal also put new data-security duties on the nonprofit that now holds the data.

Zoom out for a moment. This is a story, not advice about tests or stocks. So what actually sank 23andMe?

It sold a product people buy once and built its value on what they left behind. For years that worked. The database helped draw GSK's reported 300 million and a six-billion-dollar valuation. But anything that valuable is worth stealing, and the company's own sharing features turned 14,000 hacked accounts into a breach touching 6.9 million people. Add competition and a long slump in demand, and the asset that made 23andMe valuable helped sink it.

And what happens to your data when a company like this goes under? It can come with strings attached. Bankruptcy law already provides for a consumer privacy ombudsman in sales like this, and one reviewed the 23andMe deal.

Which brings us to now.

The business lives on as the 23andMe Research Institute, a nonprofit with its own Privacy Advisory Board. It's publishing research again, including a study in Nature this April.

Remember those 1.9 million deletion requests? This month, the Institute said it had more than 11 million consented research participants. That's a different measure from customer records. It's also nearly six times the number who asked for deletion.

Here's where it landed. The public company that once touched six billion dollars has been wound down, and whatever shareholders get back depends on a trust. The data lives on in research, inside a nonprofit led by the woman who co-founded 23andMe, with security duties the states wrote into their settlement.

In 2006, the pitch was simple: send in your spit, and we'll tell you what's in it. The public company that made that pitch didn't survive. What people sent in did.

Next time: another company whose most valuable asset turned out to be the thing that sank it.

Sources

This video tells a business story. It is not medical, legal or financial advice.

Next episode

Spirit Airlines

November 2, 2026

Subscribe to get it first