Struggling DNA testing firm 23andMe to be bought for $256m

The DNA testing firm 23andMe says it has entered into an agreement to be acquired by Regeneron Pharmaceuticals for $256m (£192m).

It comes two months after the company filed for bankruptcy protection in the US.

23andMe said Regeneron had committed to comply with its privacy policies as part of the deal, and that Regeneron has security controls in place to protect user data.

Last month, the firm agreed to have an ombudsman oversee the protection of user data in response to demands by several state attorneys general in the US.

The officials expressed concern over the potential for unscrupulous buyers to wield the data against consumers.

Regeneron will acquire nearly all of 23andMe’s assets, the company said in a statement.

Its subsidiary Lemonaid Health will be wound down under the agreement.

23andMe will continue to operate as a wholly-owned unit unit of Regeneron, which said it would use the firm’s data for drug development.

“We are pleased to have reached a transaction that maximizes the value of the business and enables the mission of 23andMe to live on, while maintaining critical protections around customer privacy, choice and consent with respect to their genetic data,” said 23andMe’s board chairman Mark Jensen.

The deal was made through auction last week as part of the company’s bankruptcy proceedings.

The company declined to comment further when approached by the BBC.

23andMe was co-founded in 2006 by Anne Wojcicki who served as CEO until stepping down in March.

Over the years, the company received high-profile endorsements from celebrities including Oprah Winfrey, Eva Longoria and Snoop Dogg.

23andMe went public in 2021, which saw its value top $6bn – but it never turned a profit.

The once-celebrated company has struggled amid weak demand for its testing kits and never managed to redefine its business model.

A subscription service failed to gain traction with customers and efforts to use its massive trove of data to move into drug development also faltered.

Then in 2023 the company experienced a data breach that exposed the genetic data of millions of users.

The firm ultimately settled a lawsuit alleging it failed to protect the privacy of nearly seven million customers whose personal information was exposed.

Hackers gained access to family trees, birth years and geographic locations, by using customers’ old passwords, but the company maintains the data stolen did not include DNA records.

Two months after the settlement, it slashed 200 jobs – about 40% of its workforce.

Ms Wojcicki tried to take the company private but was not open to a third-party takeover.

When 23andMe filed for bankruptcy protection in March, attorneys general from multiple US states advised its customers to purge their information from the firm’s database.

At the time, the company said it would continue to protect customer data as laid out in its privacy policy, and any buyer of the company would have to abide by laws that apply to how customer data is treated.

But its privacy policy also included language which allowed for personal information to be accessed, sold, or transferred if it was “involved in a bankruptcy, merger, acquisition, reorganization, or sale of assets”.

23andMe agreed to a court-appointed overseer of customer genetic data after several states alleged the company was failing to take data security seriously enough.