US biotechnology firm Regeneron has entered into an agreement to acquire 23andMe for $256 million, with the transaction expected to close in the third quarter of 2025.

The agreement comes two months after 23andMe filed for bankruptcy protection in the US.

The company, which saw its highest valuation of $6 billion in 2021, has faced declining demand for its DNA test kits after a major data breach compromised the genetic and personal information of millions of users.

In October 2023, the company was targeted by bad actors that used a process called “credential stuffing” to steal login credentials and gain access to accounts on other systems.

Around seven million people were affected by the hack due to a feature which allows DNA-related people to contact each other.

Hackers accessed DNA relatives profiled and family tree profiles, exposing personal data of 6.9 million users, the BBC reported at the time.

Data included names, birth years, location and genetic ancestry information.

The data breach prompted an investigation by the Information Commissioner’s Office (ICO) and the Office of the Privacy Commissioner of Canada (OPC).

Following the breach, 23andMe settled a $30 million lawsuit and offered identity monitoring services to affected users.

The company also enforced password resets and implemented two-step verification to prevent future attacks.

Under the terms of the takeover, Regeneron will acquire nearly all the assets of 23andMe, including its personal genome Service (PGS), total health, and research services business lines.

The deal does not include the sale of the firm’s Lemonaid Health subsidiary, which will be closed down, 23andMe said.

Regeneron has pledged to comply with 23andMe's privacy commitments and maintain strict security controls to protect user data.

To further safeguard customer data, 23andMe said a court-appointed supervisor will monitor how genetic data is handled, addressing concerns raised by lawmakers and privacy advocates.

Mark Jensen, chairman and special committee member of 23andMe's board of directors, said the sale “maximised the value of the company” while enabling 23andMe's mission.

He added the deal maintains critical protections on customers' privacy, choice, and consent in relation to their genetic data.

Commenting on the acquisition and the firm’s restructuring plans, Jensen said: “We are grateful to Regeneron for offering employment to all employees of the acquired business units, which will allow us to continue our mission of helping people access, understand and gain health benefits through greater understanding of the human genome.”

In a statement, George D. Yancopoulos, co-founder and chief scientific officer of Regeneron, assured 23andMe customers that the firm will apply high standards for safety and integrity to their data and ongoing consumer genetic services.

“We believe we can help 23andMe deliver and build upon its mission to help people learn about their own DNA and how to improve their personal health, while furthering Regeneron’s efforts to improve the health and wellness of many,” he added.

Regeneron’s acquisition process was supervised by the US Bankruptcy Court for the Eastern District of Missouri, which oversaw the bidding process.

---