23andMe hackers sought Jewish, Chinese customers’ data, class action alleges

23andMe data breach class action lawsuit overview: 

• Who: David Melvin and a customer identified as J.L. filed a class action lawsuit against personal genomics and biotechnology company 23andMe Inc. 
• Why: Melvin and J.L. claim 23andMe hid from consumers that the hacker behind an October 2023 data breach specifically sought out Chinese and Jewish customers and put their stolen private genetic information on the dark web. 
• Where: The class action lawsuit was filed in California federal court. 

Personal genomics and biotechnology company 23andMe concealed from customers that the hacker behind an October 2023 data breach specifically targeted Jewish and Chinese customers and posted their private genetic information on the dark web, a new class action lawsuit alleges. 

Plaintiffs David Melvin and J.L.’s class action lawsuit claims the 23andMe hacker compiled, as a side task, private genetic information of the company’s Jewish and Chinese users into specially curated lists that continue to be shared and sold on the dark web to this day.  

Melvin and J.L. argue 23andMe was able to review the data stolen from its Chinese and Jewish customers and how it was being sold and shared but allegedly chose to conceal the information from them. 

“To this day, 23andMe has never told its 7 million compromised customers that their (private genetic information) was disclosed on the dark web, and never told its Jewish and Chinese customers that they were specifically targeted,” the 23andMe class action states. 

Melvin and J.L. want to represent a nationwide class of individuals whose private genetic information was accessed by third parties during the 23andMe data breach, a subclass of individuals with Chinese ancestry or Ashkenazi Jewish heritage and a subclass of individuals from Oregon, Illinois or Alaska. 

Hacker leaked data of more than 1M Jewish and 350K Chinese customers, class action claims

Melvin and J.L. argue the hacker behind the 23andMe data breach leaked a list of more than 1 million Jewish customers’ data in an apparent retribution for the Israel-Hamas war and the data of 350,000 Chinese customers after a request from a user with the alias “Wuhan.” 

“These lists generated a huge amount of interest from hackers on the dark web from all over the world and were shared and reshared an untold number of times,” the 23andMe class action states. 

Melvin and J.L. further claim that, in an effort to prevent claims from being filed against it, 23andMe delayed notifying the 7 million customers affected by the data breach so it would have time to add arbitration requirements to its terms and conditions.

23andMe is accused of negligence and violating California’s Unfair Competition Law and privacy statutes in Illinois, Alaska and Oregon. 

The plaintiffs are demanding a jury trial and requesting declaratory and injunctive relief along with an award of actual, compensatory, consequential, incidental, nominal, statutory and punitive damages for themselves and all class members. 

After customers filed a separate lawsuit in Illinois relating to the 23andMe data breach, the company sent out a December letter blaming its customers for the data breach, with the company arguing those impacted had failed to update their passwords for the genetic testing service. 

Were you impacted by the 23andMe data breach? Let us know in the comments.

The plaintiffs are represented by Rafey S. Balabanian, Jay Edelson, J. Eli Wade-Scott, Michael Ovca, Emily Penkowski Perez and Hannah P. Hilligoss of Edelson PC.

The 23andMe data breach class action lawsuit is Melvin, et al. v. 23andMe Inc., Case No. 3:24-cv-00487, in the U.S. District Court for the Northern District of California.

Read About More Class Action Lawsuits & Class Action Settlements:

• 26 billion records leaked in data breach affecting Dropbox, LinkedIn, Twitter, more
• Progressive customers fight to keep data breach class action alive
• LoanDepot class action alleges company failed to prevent massive data breach
• Truepill hit with another class action over data breach