Last week, Anne Wojcicki, CEO of the technology startup 23andMe, filed for bankruptcy and announced her resignation. Six months earlier, the company’s board of directors had disbanded, citing disagreements over strategic direction.

23andMe, which once offered genetic testing for medical and genealogical purposes, collected DNA data from more than 15 million customers and was expected to be one of the world’s most valuable tech unicorns. But since going public in 2021, the company has not reported any profits.

After data theft scandals and class action lawsuits, 23andMe's 15 million customers are left wondering what will happen to their data. Many are looking to delete their information from 23andMe to avoid future problems.

DNA data is like a ticking time bomb.

In its bankruptcy filing, 23andMe said it would start having major problems related to the data hack in 2023.

In October 2023, hackers put up a massive trove of 23andMe user data for sale on the Dark Web. The data included detailed information about birth dates and names. By December, the company confirmed that hackers had accessed the genealogical data of nearly 7 million users. An estimated 14,000 user accounts were directly accessed by hackers.

By January of the following year, details of the hack revealed that it took 23andMe five months to realize the company had been hacked.

PHOTO: FT SCREENSHOT

The incident left the tech unicorn facing a $30 million lawsuit, according to Reuters. A week later, the independent directors on 23andMe's board announced their resignations.

But 23andMe’s user DNA data remains a ticking time bomb. In an effort to save the startup, its executives are looking to sell the company to pay off debt. That means user data could be sold as well.

This immediately caused a huge wave of controversy in the community. Most users objected. They believed that their personal data collected and stored by 23andMe was not a commodity to be traded or auctioned.

The director of cybersecurity at the Electronic Frontier Foundation, a nonprofit focused on digital privacy, urged users to delete their data from 23andMe. The post had been viewed 531,000 times in just three days.

“Data is data, once it's public, it's very difficult to control,” James Hazel, a biomedical researcher, told Business Insider.

23andMe says the personal data it collects includes registration information such as date of birth, genetic information such as genotype, saliva samples and self-reported information. In addition, partners under contract to process customers' saliva samples may also have access to this customer data.

A 23andMe spokesperson said the company does not share data with “employers, insurance companies, law enforcement agencies, or public databases.” But users are still concerned about their information as 23andMe’s future remains uncertain.

In the platform's health records, users can opt out of "23andMe Data." However, the company notes that it is legally obligated to retain some information.

"While we will delete most of your personal information, we must retain some information to comply with legal obligations," the company's website says. The company's privacy statement also states: "23andMe and our genetic testing partners will retain your genetic information, date of birth, and gender as required to comply with applicable legal obligations... even if you choose to delete your account."

According to experts, the collapse of 23andMe has sounded a wake-up call to users and regulators about the collection and storage of important data such as people's DNA. On the positive side, genetic data will be especially important in medicine, decoding a lot of personal information. But the risk is that once this information has been decoded and illegally accessed, it can never be restored or hidden. Once the data falls into the wrong hands, the victims' lives will be like fish on a chopping board. They cannot foresee all the risks they will face in the future.