23andMe - The Altman Network

Role in the network: TrialSpark’s genetic data partner, certified alongside TrialSpark for transatlantic health data transfers in 2014 — five years before their formal partnership was announced — whose 15 million customers’ DNA is now controlled by a founder-created nonprofit in a restructuring that mirrors OpenAI’s own for-profit-to-nonprofit conversion.

Company Bio

23andMe is a consumer genomics and biotechnology company founded in 2006 by Anne Wojcicki, Linda Avey, and Paul Cusenza. Headquartered in Sunnyvale, California, the company offered direct-to-consumer genetic testing through saliva-based DNA kits, providing customers with ancestry composition, health predisposition reports, carrier status, and trait information. At its peak the company had genotyped over 15 million people, approximately 80% of whom opted into its research database — creating one of the largest interactive genetic datasets in the world. [1]

The company went public in June 2021 through a SPAC merger with VG Acquisition Corp., a special purpose acquisition company founded by Richard Branson, at a valuation of approximately $3.5 billion. [2] Prior to the SPAC, 23andMe raised $944 million across 21 funding rounds from 31 institutional investors including Google, Sequoia Capital, New Enterprise Associates, Fidelity, Casdin Capital, and GlaxoSmithKline. [3]

In October 2023, 23andMe disclosed a data breach caused by credential stuffing in which hackers accessed 6.9 million customer profiles through the company’s DNA Relatives feature. The stolen data — ancestry results, ethnicity estimates, health predispositions, and family connections — was categorized by ethnic group and posted for sale on dark web forums, with initial datasets specifically targeting customers of Ashkenazi Jewish and Chinese descent. [4] [5]

Following the breach, declining kit sales, and the collapse of its drug development pipeline, 23andMe filed for Chapter 11 bankruptcy on March 23, 2025. Co-founder Anne Wojcicki resigned as CEO and created TTAM Research Institute, a nonprofit, which acquired substantially all of the company’s assets for $305 million in July 2025 — outbidding Regeneron Pharmaceuticals. [6] Five state attorneys general (California, Kentucky, Tennessee, Texas, and Utah) opposed the sale. [7] On May 28, 2026, the California Attorney General filed a lawsuit against 23andMe over the breach and its handling of customer data. [8]

Co-founder Linda Avey departed operational roles by 2009. Paul Cusenza exited early. Wojcicki remained as the sole enduring founder-operator through the company’s entire lifecycle — and now controls the nonprofit entity that holds the genetic data of over 15 million people.

FDA Regulatory History: The Shutdown and Return

In November 2013, the FDA issued a warning letter ordering 23andMe to stop marketing its health-related genetic tests, stating that after “more than 5 years” of marketing, the company “still had not completed some of the studies and had not even started other studies necessary to support a marketing submission.” The FDA classified the tests as medical devices requiring regulatory authorization that 23andMe had never obtained. [29] [30]

23andMe complied and ceased providing health reports, offering only ancestry data and raw genetic information until October 2015, when it relaunched with FDA-authorized carrier status reports (starting with Bloom Syndrome). In April 2017, the FDA granted authorization for health risk reports including Late-Onset Alzheimer’s Disease, Parkinson’s Disease, and Hereditary Thrombophilia. [29] [31]

The FDA shutdown is significant in context: during the two years that 23andMe could not provide health reports (2013–2015), the company continued collecting saliva samples and building its genetic database using ancestry as the sole consumer value proposition. The database grew while the health application was frozen — meaning the company accumulated genetic data from millions of people who signed up for ancestry information and later found their DNA being used for health research and drug development partnerships they didn’t originally sign up for.

The Board Exodus: September 2024

On September 17, 2024, all seven independent directors of 23andMe’s board resigned simultaneously in what Axios called “a stunning rebuke” of Wojcicki’s leadership. The departing directors were: [32] [33]

Roelof Botha — Sequoia Capital (joined board 2017 with Series F investment)
Patrick Chung — Xfund (board member since 2009, “first investor in Sam Altman”)
Neal Mohan — CEO of YouTube / Google (joined board 2017)
Sandra Hernández, M.D. — Special Committee member
Valerie Montgomery Rice, M.D. — Compensation Committee
Richard Scheller, Ph.D. — (former Genentech EVP)
Peter Taylor — Special Committee, Audit Committee

In their resignation letter, the directors wrote: “After months of work, we have yet to receive from you a fully financed, fully diligenced, actionable proposal that is in the best interests of the non-affiliated shareholders.” They cited Wojcicki’s “concentrated voting power” as a reason resignation was preferable to “a protracted and distracting difference of view.” [33]

After the mass resignation, Anne Wojcicki was the only board member remaining. She controlled the company through a dual-class share structure that gave her majority voting power regardless of economic ownership. Six months later, she took the company into bankruptcy. [32]

The parallel to OpenAI is structural: in both cases, a founder with concentrated control faced a board that questioned the direction of the company. At OpenAI, the board fired Altman and was then itself replaced. At 23andMe, the board resigned en masse rather than fight Wojcicki’s voting control. In both cases, the founder emerged with more power, not less.

Chung’s departure is particularly significant for the network. He sat on the 23andMe board for 15 years (2009–2024), spanning the TrialSpark partnership, the GSK collaboration, the breach, and the board exodus. He was also the first investor in Sam Altman (Loopt, 2005). His resignation came after the breach but before the bankruptcy — he walked away before the final collapse. [33]

The GSK Partnership and Drug Discovery Collapse

In July 2018, GlaxoSmithKline entered a four-year exclusive collaboration with 23andMe and made a $300 million equity investment. Under the deal, GSK became 23andMe’s exclusive partner for drug target discovery, using the company’s genetic database of over 5 million opted-in customers to identify and validate drug targets. All programs were co-funded 50/50, with both companies sharing proceeds from resulting treatments. [9] [10]

The partnership was extended in January 2022 to July 2023 with an additional $50 million payment. In practice, the collaboration produced only one compound that reached clinical trials — an immuno-oncology antibody targeting CD96, which entered Phase I. 23andMe opted to take a royalty position on CD96 rather than co-fund development, and opted out of several other joint programs. [11]

When the exclusive period ended in mid-2023, GSK chose not to continue co-developing new programs. The arrangement was replaced by a scaled-down, non-exclusive data licensing deal: GSK paid $20 million for a one-year license to 23andMe’s database insights. Under the amended terms, any new drugs would belong solely to GSK, with 23andMe eligible only for royalties. [12]

By late 2024, 23andMe scrapped its entire in-house drug development program and cut 40% of its workforce. The $300 million GSK partnership — the company’s most prominent commercial bet beyond consumer kits — had produced no approved treatments and no breakthrough targets. [12]

The TrialSpark / Formation Bio Connection

The relationship between 23andMe and TrialSpark (now Formation Bio) predates their public 2019 partnership by five years.

On November 12, 2014, TrialSpark was certified under the EU-US Safe Harbor framework for transatlantic personal data transfers. Six days later, on November 18, 2014, 23andMe received the same certification. Both companies were certified for cross-border health data transfers in the same week — a fact documented in congressional record HHRG-114-IF16-20151103-SD015 from a November 3, 2015 House hearing. [13]

In April 2018, Sam Altman interviewed Anne Wojcicki on the Y Combinator podcast — eighteen months before the formal partnership was announced. [14]

In September 2019, TrialSpark and 23andMe announced a partnership for clinical trial recruitment using genetic data, with an RFP documented on the Wayback Machine showing that TrialSpark sought to leverage 23andMe’s genetic database to identify and recruit clinical trial participants based on genetic markers. [15]

On December 5, 2023 — the same day TrialSpark rebranded as Formation Bio — Hardcore Technology LLC (the SEO company that placed Formation Bio’s clinical phlebotomy partner Speedy Sticks at Formation Bio’s address on Google Maps) published its first blog post and X post about the 23andMe data breach. The timing is precise: the rebrand-day content from an entity in the daisy chain was about the former partner’s data breach. [16]

The Breach: Targeted Ethnic Data Harvesting

The October 2023 breach was not a conventional data theft. The hacker, operating under the alias “Golem,” specifically organized and marketed the stolen data by ethnic category. The initial proof-of-concept leak contained one million profiles of Ashkenazi Jewish customers and 100,000 profiles of Chinese customers, advertised at $1–$10 per account on BreachForums. An additional list of 350,000 Chinese customers was leaked upon request from a user with the alias “Wuhan.” [4] [17] [18]

The breach exploited the DNA Relatives feature — a social-networking-style tool that connects customers who share DNA segments. Only 14,000 accounts were directly compromised through credential stuffing, but each breached account gave the attacker access to the profile data of every DNA Relative connected to it, cascading the exposure to 6.9 million profiles — nearly half the company’s total customer base. [5] [19]

The compromised data included ancestry reports, ethnicity estimates, health predisposition reports, birth years, self-reported locations, display names, relationship labels, and DNA segment matching information. Unlike passwords or credit card numbers, genetic data cannot be changed. [5]

U.S. Senator Bill Cassidy wrote to Wojcicki expressing “significant concern” and noting the data posed particular safety risks for Chinese citizens given the Chinese government’s history of tracking its nationals abroad. [18]

The TTAM Acquisition: Buying Back Your Own Company at 91% Off

The numbers tell the story of how Anne Wojcicki reacquired control of 15 million people’s genetic data at a fraction of its former value.

Asset	Original Value	TTAM Acquisition Price	Loss
23andMe (company)	$3.5B (SPAC valuation, Jun 2021)	$305M (Jul 2025)	91.3%
Lemonaid Health	$400M (acquisition price, Oct 2021)	$10M (sold separately, Sep 2025)	97.5%
Total capital raised	$944M (21 rounds)	—	—
GSK investment alone	$350M ($300M equity + $50M extension)	—	—

Wojcicki resigned as CEO on March 23, 2025 — the same day the company filed for bankruptcy. She immediately created TTAM Research Institute (an acronym for Twenty-Three And Me) as a nonprofit. TTAM then bid against Regeneron Pharmaceuticals, which offered $256 million with assurances about privacy protections. TTAM won with a $305 million bid after the bankruptcy court reopened the auction in June 2025 following Wojcicki’s claims that TTAM had been “unfairly excluded from the bidding process.” [6] [7] [22]

Public Citizen characterized the transaction as “self-dealing,” writing that it “appears to allow a failed for-profit enterprise to shed its debts, rebrand as a nonprofit, and reacquire its most valuable asset: the genetic data of over 15 million individuals.” The bankruptcy judge noted that TTAM is composed of “the same business, the same employees, familiar leaders, and the same privacy policies.” [20]

The structural parallel to OpenAI is exact: a founder creates an entity, it grows using other people’s data/money, governance questions arise, the founder transitions between corporate structures (for-profit ↔ nonprofit) while maintaining personal control of the valuable assets. Public Citizen independently used the word “self-dealing” to describe both the 23andMe/TTAM transaction and OpenAI’s governance restructuring. [20]

Only approximately 2 million of 15 million customers deleted their data following the bankruptcy and acquisition. Federal laboratory regulations require retention of de-identified genetic data even after account deletion, meaning some information persists in anonymized form regardless of customer action. [6]

Five state attorneys general — California, Kentucky, Tennessee, Texas, and Utah — opposed the sale. On May 28, 2026, the California Attorney General filed a separate lawsuit against 23andMe over the breach and its handling of customer data, alleging the company violated California law and “lied to consumers about the severity of the data breach.” [7] [8]

Lemonaid Health: The Prescription Pipeline

In October 2021 — four months after going public — 23andMe acquired Lemonaid Health for $400 million (25% cash, 75% stock). Lemonaid is a telehealth and prescription drug delivery platform offering $25 online doctor visits, same-day prescription shipping, and treatment for conditions including anxiety, depression, UTIs, birth control, hair loss, erectile dysfunction, and chronic disease management. [23] [24]

The stated vision was “genetically-informed primary care” — using 23andMe’s pharmacogenetics reports to determine which drugs would work best for each patient, then prescribing and delivering those drugs through Lemonaid’s platform. Wojcicki described it as giving patients “not just their genetic information, but actually pulling it through and applying it to their healthcare.” [24]

The pipeline this creates: genetic screening (23andMe) → risk identification → telehealth consultation (Lemonaid) → prescription and delivery → ongoing monitoring. This is a closed-loop patient data system: DNA goes in one end, prescriptions come out the other.

Lemonaid Health also had UK operations under co-founder Ian Van Every, who served as Managing Director for the UK market. This international presence connects to the Safe Harbor data transfer certification — Lemonaid’s UK arm could have served as a conduit for transatlantic health data flows. [25]

When TTAM acquired 23andMe out of bankruptcy for $305 million, Lemonaid was initially included. It was then sold separately in September 2025 for just $10 million — a 97.5% loss from the $400 million acquisition price four years earlier. The buyer and the current status of Lemonaid’s patient data, prescription records, and UK operations have not been fully disclosed. [26]

Safe Harbor and Overseas Data Sharing

The EU-US Safe Harbor framework, certified by the US Department of Commerce, governed transatlantic transfers of personal data from Europe to the United States. Companies certified under Safe Harbor were explicitly authorized to receive, process, and store European citizens’ personal data — including health data — on US servers.

On November 12, 2014, TrialSpark (then operating as LabNook) was certified under Safe Harbor. Six days later, on November 18, 2014, 23andMe received the same certification. Both certifications appear in congressional document HHRG-114-IF16-20151103-SD015. [13]

What this means: Both companies were simultaneously authorized to transfer health data across the Atlantic in the same week — five years before their public partnership. In 2014, TrialSpark was a research social network that had just pivoted to clinical trials, and 23andMe was building the world’s largest consumer genetic database. Both were handling health data. Both were certified to move that data overseas in the same seven-day window.

The Safe Harbor framework was invalidated by the European Court of Justice in October 2015 (Schrems I decision) and replaced by Privacy Shield, which was itself invalidated in 2020 (Schrems II). The current framework is the EU-US Data Privacy Framework (2023). The question is what data moved between these entities during the Safe Harbor window and under what subsequent frameworks.

Lemonaid Health’s UK operations add another dimension: a 23andMe subsidiary operating in the UK would have been subject to GDPR (and its UK equivalent) and could have served as a node in transatlantic data flows. The ICO (UK Information Commissioner’s Office) issued a notice of intent to fine 23andMe £4.59 million specifically for the 2023 breach, indicating that UK customers’ data was affected. [27]

Several investors appear in both 23andMe and Formation Bio (formerly TrialSpark), creating financial ties between the two companies beyond their operational partnership.

Investor	23andMe	Formation Bio	Notes
Sequoia Capital	Series F, 2017 (Roelof Botha, board seat)	Every round, seed–D (Alfred Lin, Michael Moritz)	Same firm in both companies
Casdin Capital	Series E, 2015	Series C, 2021	Life sciences specialist in both
NEA	Series A, 2007	Patrick Chung (NEA → Xfund) on 23andMe board 2009–2024 AND was “first investor in Sam Altman” (Loopt)	Chung bridges both ecosystems
Founders Fund	Early investor	Thiel network throughout Altman investigation	Peter Thiel network
Google / GV	$3.9M (2007), ongoing	Google = Gemini (OpenAI competitor), Sergey Brin receiving ChatGPT data per Couture lawsuit	Wojcicki married to Brin until 2015
6 Dimensions Capital	Series E, 2015	—	Chinese VC; Formation Bio sources drugs from Chinese pharma
WuXi Healthcare Ventures	Early investor	—	Major Chinese CRO; Formation Bio subsidiaries Bleecker Bio and Kenmare Bio license drugs from Chinese companies

Patrick Chung (Xfund) is the critical bridge node: he sat on 23andMe’s board for 15 years (2009–2024), invested in Altman’s first company Loopt, and is described as “the first investor in Sam Altman.” His dual positioning connects the genetic database to the clinical trial pipeline through personal relationships, not just corporate partnerships. [21]

Key People

Person	Role	Network Connection
Anne Wojcicki	Co-founder, CEO (2006–2025), TTAM founder	Ex-wife of Sergey Brin (Google). Controls 15M people’s DNA through TTAM. Interviewed by Altman on YC podcast 2018.
Linda Avey	Co-founder (departed 2009)	Later co-founded Curious Inc. (consumer health).
Paul Cusenza	Co-founder (departed ~2007)	Early exit. Financial markets background.
Roelof Botha	Board member (2017–)	Sequoia Capital. Also on Sequoia board with Moritz (Formation Bio investor).
Neal Mohan	Board member (2017–)	YouTube CEO (Google). Joined board same round as Sequoia.
Patrick Chung	Board member (2009–2024)	NEA/Xfund. “First investor in Sam Altman.” 15-year board tenure spanning partnership, breach, and bankruptcy.

Timeline

Date	Event
2006	Founded by Wojcicki, Avey, Cusenza in Mountain View, CA
May 2007	Series A — NEA, Google ($3.9M)
Nov 2010	Series C — Johnson & Johnson Development Corp, NEA, Google Ventures
Nov 2013	FDA orders 23andMe to stop marketing health reports. Company continues selling ancestry tests and collecting DNA. Database grows without health application.
Nov 12, 2014	TrialSpark certified for Safe Harbor data transfers
Nov 18, 2014	23andMe certified for Safe Harbor data transfers — 6 days later
Oct 2015	FDA authorizes carrier status reports (Bloom Syndrome). Health testing resumes in limited form. Series E — Fidelity, Casdin Capital, 6 Dimensions Capital (China).
Apr 2017	FDA authorizes health risk reports: Late-Onset Alzheimer’s, Parkinson’s, Hereditary Thrombophilia
Sep 2017	Series F ($250M) — Sequoia (Botha joins board), Altimeter, Wallenberg, Euclidean
Apr 2018	Altman interviews Wojcicki on YC podcast
Jul 2018	GSK partnership + $300M equity investment. 4-year exclusive.
Sep 2019	TrialSpark–23andMe partnership announced — genetic trial recruitment
Jun 2021	SPAC merger with VG Acquisition Corp. (Richard Branson). NASDAQ: ME. $3.5B valuation.
Oct 2021	23andMe acquires Lemonaid Health for $400M — telehealth + prescription delivery
Jan 2022	GSK partnership extended to July 2023 with $50M payment
Mid-2023	GSK exclusivity ends. Scaled down to $20M non-exclusive data license.
Apr–Sep 2023	Credential stuffing attack underway (undetected for months)
Oct 2023	Breach disclosed. 6.9M profiles. Golem leaks Jewish and Chinese customer data on dark web.
Dec 2023	23andMe changes terms of service to add class-action waiver. Same month as Formation Bio rebrand.
Sep 17, 2024	ALL SEVEN independent directors resign en masse — Botha (Sequoia), Chung (Xfund), Mohan (YouTube/Google), Hernández, Rice, Scheller, Taylor. Wojcicki is sole remaining board member.
Late 2024	Drug development program scrapped. 40% workforce cut. Lemonaid begins prescribing GLP-1 weight loss drugs (Ozempic/Wegovy) in revenue desperation.
Mar 23, 2025	Chapter 11 bankruptcy filed. Wojcicki resigns as CEO.
May 2025	Wojcicki creates TTAM Research Institute (nonprofit)
Jun 30, 2025	Bankruptcy court approves TTAM acquisition ($305M) over Regeneron ($256M)
Jul 14, 2025	TTAM acquisition closes. 23andMe becomes nonprofit-controlled.
Jan 30, 2026	$50M class action settlement receives final court approval
May 28, 2026	California AG files lawsuit against 23andMe over breach and data handling

Nodes and Open Questions

What happened to the 23andMe–TrialSpark partnership data after the rebrand? TrialSpark became Formation Bio in December 2023 — the same month 23andMe changed its terms of service post-breach. Did Formation Bio retain access to genetic recruitment data from the 2019 partnership?
Patrick Chung’s dual positioning: He was on the 23andMe board for 15 years AND was the first investor in Sam Altman. What did he know about both the TrialSpark partnership and the breach? He departed the board in 2024 — after the breach but before the bankruptcy.
Safe Harbor certification timing (Nov 2014): Why were TrialSpark and 23andMe certified for transatlantic data transfers in the same week, five years before their public partnership? Who coordinated this? Was data flowing between them before 2019?
The breach targeting: Golem specifically organized data by Jewish and Chinese ethnicity. Formation Bio sources drugs from Chinese pharmaceutical companies (Bleecker Bio/Lynk, Kenmare Bio/CTFH). WuXi Healthcare Ventures (Chinese CRO) was an early 23andMe investor. 6 Dimensions Capital (Chinese VC) invested in Series E. Is there a connection between the Chinese ancestry data targeting and the network’s Chinese pharma sourcing?
Discover23 platform: Before bankruptcy, 23andMe launched Discover23 — enabling “authorized collaborators” to access GWAS data on 1,000+ disease cohorts from 4.7 billion phenotypic data points. Who were these collaborators? Was Formation Bio one of them?
TTAM’s future: Federal lab regulations require retention of de-identified genetic data even after customers delete accounts. TTAM has stated it will honor existing privacy policies, but the bankruptcy judge noted TTAM has “the same business, same employees, familiar leaders, and same privacy policies.” What prevents TTAM from licensing genetic data to pharmaceutical companies — including Formation Bio or its partners?
The ICO fine: The UK Information Commissioner’s Office issued a notice of intent to fine 23andMe £4.59 million for the breach. How does this interact with TTAM’s acquisition? Does TTAM inherit the liability?
Lemonaid Health buyer and data: 23andMe paid $400M for Lemonaid in 2021. TTAM sold it separately for $10M in September 2025. Who bought it? What happened to the patient prescription records, the clinical algorithms, the UK operations, and the doctor network? A telehealth platform with prescription delivery capabilities and an existing patient base is a clinical trial recruitment tool — whoever bought it acquired a healthcare data pipeline at a 97.5% discount.
December 2023 convergence: The Formation Bio rebrand, the Hardcore Tech 23andMe blog post, and 23andMe’s terms-of-service class-action waiver change all occurred in December 2023. Was this coordinated or coincidental?
Casdin Capital and Sequoia invested in both companies. Standard VC portfolio overlap, or strategic positioning across the genetic-data-to-drug-pipeline?
Safe Harbor data flows 2014–2015: Both TrialSpark and 23andMe were certified for transatlantic data transfers in the same week. What data moved between November 2014 and October 2015 (when Safe Harbor was invalidated)? Was data shared between the two companies before their public partnership?
The “Wuhan” request: The breach data included 350,000 Chinese customer profiles leaked specifically upon request from a user with the alias “Wuhan.” Formation Bio sources drugs from Chinese pharmaceutical companies (Bleecker Bio/Lynk Pharmaceuticals, Kenmare Bio/CTFH). WuXi Healthcare Ventures was an early 23andMe investor. Is there a connection between the Chinese ancestry data targeting and the network’s Chinese pharma operations? [28]
Valuation collapse beneficiaries: 23andMe went from $3.5B (2021) to $305M (2025) — 91% destruction. Who shorted the stock? Who knew about the breach before disclosure? The credential stuffing attack ran April–September 2023 (five months undetected). Insiders with knowledge of the breach had months to trade on material non-public information.
The complete patient pipeline (if reassembled): Genetic screening (23andMe/TTAM data) → risk identification → telehealth consultation (Lemonaid or successor) → clinical trial recruitment (Formation Bio/Speedy Sticks) → blood draws at home (Speedy Sticks mobile phlebotomy) → drug administration → outcome data fed back to AI (Muse/OpenAI). Every step in the pipeline is controlled by entities in this network.