23andMe Sold Spit Kits to Buy a Drug Company. The Drug Company Never Arrived.

You spat in a tube, mailed it, and a few weeks later learned you were 3% Neanderthal and slightly more likely to dislike cilantro. The kit cost less to buy than it cost 23andMe to process, sequence, and ship — which is to say the product you paid for was never really the product. You were the supplier. The thing 23andMe was actually building, one saliva sample at a time, was a genetic database of more than ten million consented people,¹⁰ and that database had exactly one customer it was designed for: a drug company that would turn your DNA into medicine and pay 23andMe a fortune for the privilege. In 2018, that customer signed up and wrote a $300 million check.³ By 2023, it had renewed on terms that fundamentally changed the idea.

The official story is that 23andMe was a thriving genetics company brought down by a catastrophic data breach. That story is wrong in the way most obituaries are wrong — it names the symptom and calls it the cause. The breach was real. But 23andMe was already dying of something the headlines couldn't photograph: a business model that had no second act, and a partner who had just told the company, in the flat language of a licensing agreement, that the second act was cancelled.

The kit was never the business. The kit was the bait.

Here is the architecture, stripped to the wire. A direct-to-consumer DNA kit is a terrible standalone business — it's a one-time purchase with no recurring revenue, and most customers never buy a second one. 23andMe knew this. The model was never "sell kits at a profit." The model was "sell kits at a loss to accumulate the largest pool of consented genetic data on earth, then sell access to that pool to pharma." In July 2018, GSK validated the whole thesis: a four-year exclusive discovery collaboration, $300 million in equity, and a shared stake in any drugs the database produced.³ That was the moment the spit-kit-as-loss-leader strategy looked brilliant. The cash burn on consumer kits wasn't a problem; it was the cost of acquiring the asset GSK was paying to mine.

And for a while, the pipeline looked alive. By January 2022, 23andMe and GSK announced they had "identified over 40 therapeutic programs" and pushed one immuno-oncology antibody into a Phase 1 trial, with GSK adding another $50 million to extend the deal.⁴ Forty programs. One in the clinic. The story wrote itself: the data was working, the drugs were coming, the payoff was a matter of time.

The day the only customer downgraded the relationship

In July 2023, the exclusive discovery term with GSK ended — and it did not renew on the old terms.⁵ The partnership that was supposed to be a joint engine for inventing drugs collapsed into a $20 million upfront payment for a one-year, non-exclusive data license, with GSK retaining sole ownership of anything it discovered and 23andMe demoted to a recipient of possible future royalties.⁹ Read that downgrade carefully, because it is the entire story. "Exclusive joint R&D partner with a stake in the drugs" and "one of several companies that can rent our data for a flat annual fee" are not two versions of the same deal. They are a thesis and its falsification. GSK had spent four years inside the database — the best possible position from which to judge whether it would actually produce blockbuster medicines — and it voted with its renewal terms. It paid less, demanded nothing exclusive, and kept the upside for itself.

If the data had been the moat 23andMe claimed, GSK would have re-signed exclusive and paid more, not less. Instead it paid a rental fee for optionality and walked away from the partnership. The most informed buyer on the planet had appraised the crown jewel and concluded it wasn't worth owning a stake in the output. Everything after that — the layoffs in August 2023, the half-billion-dollar net loss, the Board's decision in November 2024 to shut down substantially all of Therapeutics — was just the company catching up to what GSK already knew.⁵⁶

Why the breach is a distraction, not an explanation

The October 2023 breach is the part everyone remembers, and it deserves to be understood precisely, because even the disaster was self-inflicted by design. Attackers didn't crack 23andMe's platform. They ran a credential-stuffing attack against roughly 14,000 accounts using passwords stolen from other sites — and then 23andMe's own opt-in DNA Relatives feature did the rest, fanning those 14,000 footholds out into the exposed data of 6.9 million users.⁷ The company's social-sharing product was the attack multiplier. That's a damning fact about its security posture. It is not a fact about why the company failed. The proposed $30 million settlement was largely covered by cyber insurance, with about $25 million expected from the policy.⁷ A company with a working business model survives a $5 million net cash hit. A company already losing half a billion a year, with its anchor pharma partner gone, does not — and the breach simply removed the last thing it had left to sell: trust.

Wasn't it just a great idea that needed more time?

The fair objection is that drug discovery is a decade-long game, and 23andMe simply ran out of runway before a single hit could pay off — that the model was sound and the timing was cruel. There's truth in it: real therapeutics genuinely do take ten-plus years, and the CD96 antibody was a legitimate clinical asset. But the objection misreads what killed the company. 23andMe didn't fail because no drug had reached market yet; it failed because the entity best positioned to bet on those drugs reaching market — GSK, sitting inside the data for four years — declined to keep betting on the terms that mattered. You don't need to wait a decade to know the thesis is broken when your most informed partner has already priced it as a commodity. The honest counter cuts the other way too: maybe the kit business could have stood alone as a modest, profitable health-and-ancestry service. Perhaps. But it was never built or capitalized to be modest. It was built to feed a drug company, and when the drug company stopped eating, there was no business left underneath — only a costly habit of collecting saliva for a buyer who had moved on.

The ending has a strange symmetry. After the March 2025 filing, Regeneron lined up as stalking-horse bidder at $256 million, but the assets ultimately went for over $300 million to TTAM Research Institute — a nonprofit founded by Anne Wojcicki, 23andMe's own co-founder, who closed the deal on July 14, 2025.⁸ The person who built the thing bought it back out of its own grave. What she paid for was never the spit kit and never the drugs. It was the database — more than 15 million people's genomes¹⁰ — which turns out to be exactly what GSK had appraised and declined to own. 23andMe spent more than a decade and billions of dollars proving a single uncomfortable thing: collecting the most intimate data on earth is not the same as having a business model. The asset was real. The buyer for it, at the price the whole company was built around, never existed.