Estate Sale

A bankruptcy court has finally put a price on losing your genome. About $2.60, and that's for the whole thing, in case you were hoping it was per gene.

And $2.60 is only the states' share. Throw in the consumer class action and the price climbs all the way to about $9.40.

Every step of this got covered as its own story, and it's one story. In 2023, a credential-stuffing attack exposed profile data on 6.9 million people. In March 2025, 23andMe filed Chapter 11, and its most valuable asset, by a wide margin, was the DNA database itself. Twenty-seven states and the District of Columbia sued to block the sale of genetic information without customer consent. The court approved the sale anyway, with privacy commitments attached, and TTAM closed the deal on July 14, 2025. The states' settlement over the breach landed July 14, 2026, a year to the day. First the estate sold the genomes, and then it settled up for losing them with the change.

That day, a coalition of more than forty attorneys general announced a settlement with 23andMe's bankruptcy trustee over that breach. The states were granted $150 million in allowed claims. What they will actually collect is $18 million, because that's what remains in the estate after everyone ahead of them in line got paid. Pennsylvania and New Jersey, two of the bigger states in the coalition, walk away with about $492,000 and just under $410,000. Spread $18 million across the 6.9 million people whose data walked out the door, and you get about $2.60 apiece. Add the $46.75 million the same court approved for the consumer class action a week earlier, and you get to about $9.40. I ran that math twice, hoping it would improve. It didn't.

Don't mistake the $18 million for a fine. A fine is a punishment, calibrated to deter. This was a claim in a bankruptcy, calibrated to whatever was left in the drawer. What your genome is worth depends entirely on which room you ask in. In the marketing room, it was worth a $99 kit and a lifetime of insight about your Neanderthal percentage. In the auction room in June 2025, Regeneron thought the database was worth $256 million for drug discovery, and Anne Wojcicki's nonprofit TTAM won it at $305 million. In the courtroom, a year later: about $9.40, with the same molecules and the same double helix. The price is a property of the venue, and the only room that sent any money back toward the people in the database was the cheapest one.

I think there's a fundamental unpleasantness that turns over all this. A privacy policy is a promise, and in bankruptcy a broken promise becomes an unsecured claim, the cheapest seat in the house, with the secured lenders eating first. Then the professionals administer the estate, billing it by the hour, and FINALLY, from whatever is left, the unsecured claims. Which is where "we will never sell your data" lives, right next to the unpaid landscaping invoice. Twelve cents on the dollar, which is what $18 million against $150 million works out to, is honestly a respectable recovery for that tier, and that is a hell of a sentence to write about your DNA. The system worked EXACTLY as designed, and the design is the problem. You cannot repossess a promise.

(And before anyone emails me: yes, the court attached privacy commitments to the sale, and yes, the buyer promised to keep the data safe. Maybe it keeps every one of those promises! But they are still promises, and we just went over what a promise fetches in that courtroom.)

With most data, this is bad. With DNA, it's a different category of bad, because a genome is the one credential you cannot rotate. Your password leaks; you change it. Your credit card leaks; the bank mails you a new one. Your genome leaks, and nobody mails you new chromosomes. It stays leaked for the rest of your life, and for a meaningful fraction of your siblings' and children's lives too, since they share the sequence and never clicked "I agree" on anything. The 6.9 million people in the breach consented, in the loose sense that word has acquired. Their relatives were simply along for the ride. Data outlives the company that collected it, and this particular data outlives the people it describes.

Genomes are the newest entry in a bankruptcy playbook whose receipts go back a quarter century. In 2000, a Disney-backed toy retailer called Toysmart went under with a privacy policy that promised customer data would never be shared with third parties. The bankruptcy listed the customer database, including data on children, as an asset for creditors, and the FTC sued to stop the sale. The settlement restricted the sale to a buyer in the same line of business, and in the end Disney paid to have the list destroyed. Fifteen years later, RadioShack (yes, that RadioShack) went into bankruptcy carrying more than 65 million customer names and 13 million email addresses on its asset schedule, auctioned them, and got 38 attorneys general objecting before a deal destroyed most of the data. Toy shoppers, battery buyers, genomes. The asset class keeps upgrading, and the playbook hasn't changed at all. I'll let you guess what ends up on the folding table next. (Hint: ask your chatbot what it remembers about you.)

I keep coming back to the same conclusion, and I promise it's not just because of where I work. (Okay, it's a little because of where I work). Paper guarantees have a documented lifespan, and it's shorter than a mortgage. The settlement's forward-looking fix, for the record, is a risk analysis, an advisory board on data security, and continued deletion rights at the buyer, which has since re-registered as 23andMe Research Institute. More paper, under the old name. The version of "we will never sell your data" that actually survives a bankruptcy is where the engineering and data teams take on the work long before bankruptcy is ever considered. Data that gets processed where it's generated, and never piles up in one central database, can't be inventoried by a trustee, can't be auctioned to the highest bidder, and can't be marked down to less than ten bucks in a courtroom you will never see. We usually sell data locality on latency and egress fees, and those are real. The 23andMe estate just made the other argument for us: blast radius. A trustee cannot sell what the debtor never possessed.

An estate sale can only sell what's in the house. Maybe stop filling the house.

Want to process data where it's generated, so there's never a pile for a trustee to auction? Check out Expanso. Or don't. Who am I to tell you what to do.

NOTE: I'm currently writing a book based on what I have seen about the real-world challenges of data preparation for machine learning, focusing on operational, compliance, and cost. I'd love to hear your thoughts!