California AG Rob Bonta has filed suit against Chrome Holding Co. (formerly 23andMe) over its 2023 credential stuffing breach, which exposed genetic and personal data for approximately 855,000 California residents by exploiting the platform’s DNA Relatives social-graph feature. The lawsuit alleges failure to implement basic authentication controls and proper breach notification. For any organization operating consumer-facing applications with social or graph features, this case is a direct reference for the legal consequences of inadequate brute-force protection and improper access control on authenticated data-sharing features.