23andMe Acquisition by Regeneron: Data Privacy and Security Implications

The struggling DNA testing firm 23andMe is set to be acquired by Regeneron Pharmaceuticals for $256 million, a deal that includes commitments to protect user data. This acquisition, finalized through a bankruptcy auction, raises critical questions about the future of 15 million customers’ genetic information and the broader security implications for sensitive health data.

Deal Overview and Data Commitments

Regeneron Pharmaceuticals, a biotech giant with a $64 billion market cap, will acquire 23andMe as a wholly owned subsidiary. The deal, expected to close in Q3 2025, includes winding down 23andMe’s telehealth arm, Lemonaid Health. Regeneron has pledged to maintain existing privacy policies and use genetic data exclusively for drug research and development. A court-appointed ombudsman will oversee compliance with state attorneys general agreements, addressing concerns about data misuse.

Privacy Risks and Past Breaches

23andMe’s 15 million user profiles, including family trees and demographic data, have been exposed in past breaches. While raw DNA data remained secure, the 2023 incident highlighted vulnerabilities in the company’s infrastructure. The bankruptcy filing further complicated matters, with experts urging users to delete their data pre-acquisition. Regeneron’s control of this dataset introduces new risks, particularly around biopharma partnerships and potential secondary uses of genetic information.

Security Implications for Enterprise Stakeholders

The handling of sensitive genetic data during corporate transitions presents unique challenges. Key considerations include:

Data retention policies during asset transfers
Third-party access controls for research partners
Audit mechanisms for court-ordered oversight

For security teams, the case underscores the need for robust data governance frameworks when dealing with highly personal information. The appointment of an ombudsman sets a precedent for judicial oversight in similar acquisitions involving sensitive data.

Broader Industry Context

23andMe’s decline from a $6 billion valuation to bankruptcy reflects wider challenges in consumer genomics. The company never achieved profitability, with demand for ancestry kits declining post-pandemic and failed pivots to drug development. November 2024 saw 40% workforce cuts (200 jobs), followed by CEO Anne Wojcicki’s resignation in March 2025. These business failures compounded security risks as resources for data protection diminished.

The acquisition represents a cautionary tale about the intersection of biotechnology, data security, and corporate viability. As genetic testing becomes more prevalent, the 23andMe case highlights the need for clear regulatory frameworks governing data protection during corporate transitions, particularly in bankruptcy scenarios.