Concerns have been raised about how 23andMe could potentially handle customer information due to the company's uncertain future.
The South San Francisco-based DNA and ancestry company is currently floundering, and customers have raised concerns about what may happen to their personal information if the company is sold.
"The business model is the issue. If I do the test once, I am done, and I don't have to do it again, which is why they are struggling," said San Jose State University Professor Ahmed Banada, who studies technology and cybersecurity.
In October 2023, the company was hacked, exposing the personal information of nearly 7 million customers.
Get top local stories in Southern California delivered to you every morning. >Sign up for NBC LA's News Headlines newsletter.
"In early October, we learned that a threat actor accessed a select number of individual 23andMe.com accounts through a process called credential stuffing," according to a 23andMe blog post at the time. "That is, usernames and passwords that were used on 23andMe.com were the same as those used on other websites that have been previously compromised or otherwise available."
Last month, the company settled for $30 million with the millions of customers who were impacted by the breach. Following the settlement, all seven of the company's independent board members resigned.
Banafa said that with the company's uncertain future, he advises 23andMe's 15 million users to act now.
U.S. & World
News from around the country and around the globe
"If another company takes over, they are going to set up their own rules," he said. "it is your right to send a letter or an email telling 23andMe to stop using my data because once they have a new company, it will be very difficult to get that kind of right,"
Despite generating $299 million in 2023 and $219 million in 2024, the company remained unprofitable. 23andMe's stock price peaked in February 2021 and has seen a sharp decline, hitting an all-time low of 29 cents.
While users can request information be deleted on the company's website, its privacy statement states that it will hold on to genetic information for at least two years. The company cites the timeframe is due to legal obligations, including federal lab regulations.
23andMe told NBC Bay Area it is committed to protecting customer data and has no plans to sell.
"23andMe's Co-Founder and CEO Anne Wojcicki has publicly shared she intends to take the company private and is not open to considering third-party takeover proposals," the company said in a statement. "Anne also expressed her strong commitment to customer privacy and pledged to maintain our current privacy policy."
