23andMe customer data will be used for drug research following acquisition, Regeneron says

US drug maker Regeneron on Monday said it will use 23andMe customer data for research, just hours after it announced plans to purchase the bankrupt company in a $256 million deal.

Regeneron Pharmaceuticals announced it had entered into a purchase agreement after submitting a bid for the human genetics and biotechnology company at a bankruptcy auction held last Wednesday.

The commercial drug manufacturer said it plans for 23andMe “to continue all consumer genome services uninterrupted,” in the name of improving human health and wellness – all while prioritizing the privacy of 23andMe’s customer data.

Based in Westchester, New York, Regeneron additionally said it plans to leverage 23andMe's dataset of customer DNA profiles for drug discovery purposes, according to a press release.

“Since 2013, the Regeneron Genetics Center has sequenced the genetic information of nearly three million people in research studies, using this deidentified data to make meaningful discoveries at speed and scale," it said.

📣Today we announced that we intend to acquire @23andMe with plans to maintain their consumer genetics business and advance our shared goal of improving human health and wellness. https://t.co/cujfaF5rF2

undefined Regeneron (@Regeneron) May 19, 2025

“We assure 23andMe customers that we are committed to protecting the 23andMe dataset with our high standards of data privacy, security, and ethical oversight,” said Aris Baras, MD, Senior Vice President and Head of the Regeneron Genetics Center.

Baras said the Regeneron Genetics Center has a "proven track record” of safeguarding the genetic data of people across the globe.

23andMe hackers stole raw genotype data in 2023 breach

Founded in 2006, the San Francisco-based 23andMe is known for its direct-to-consumer testing kits, in which customers send in a saliva sample in return for their personalized DNA results.

The human genetics company filed for Chapter 11 bankruptcy on March 23rd, just two months after revealing to the US Securities and Exchange Commission (SEC) that threat actors had gained unauthorized access to its servers – and a reported 7 million customers’ private genetic data during the five-month-long 2023 breach.

23andMe claimed to have sold more than 12 million DNA test kits at the time, leaving customers not only worried about what private information was stolen in the attacks, but also the fate of their genetic data in light of an impending bankruptcy sale.

The sensitivity of a potential sale prompted the US Federal Trade Commission (FTC) to preemptively warn the US trustee handling the case that any purchaser was beholden to 23andMe’s original data protection policy as written.

Regeneron said on Monday it intends to ensure full compliance with 23andMe’s consumer privacy policies and applicable laws with respect to the treatment of customer data.

“We have deep experience with large-scale data management, having worked with collaborators around the world to link deidentified DNA sequences from nearly three million consented participants to electronic health records, safely and securely enabling future medical advances,” Regeneron co-Founder, Board co-Chair, President and Chief Scientific Officer George D. Yancopoulos, M.D. Ph.D said.

“Regeneron was one of the first biotech companies to bet its future on the power of DNA, delivering some of the world’s leading and most innovative medicines… including treatments to prevent blindness, for allergic diseases from asthma to atopic dermatitis, for several forms of cancer, and even for Ebola and COVID-19,” Yancopoulos said.

The company further noted it will detail its intended use of customer data, including the privacy programs and security controls in place, for review by a court-appointed, independent Customer Privacy Ombudsman and other interested parties,” pending a final hearing to approve the $256 million sale on June 14th.

The drug maker did not say at this time whether customers will have the option to opt out of their DNA profiles being used for research.

The sale itself covers 23andMe’s Personal Genome Service® (PGS), Total Health and Research Services business lines, along with its Biobank and associated assets. It does not include 23andMe’s Lemonaid Health business, the announcement stated.

The purchase transaction is expected to close in the third quarter of 2025, it said.