Connect with us

Published

on

Dutch firm ASML makes one of the most important pieces of machinery required to manufacture the most advanced chips in the world. U.S. chip curbs have left companies, including ASML, scrambling to figure out what the rules mean in practice.

Emmanuel Dunand | AFP | Getty Images

ASML, which makes machines that are critical to manufacturing the most advanced semiconductors, was barred by the Dutch government from exporting some of its tools to China, the company said.

In a statement released Monday, ASML, which is headquartered in Veldhoven, Netherlands, said a license for the shipment of its NXT:2050i and NXT:2100i lithography systems in 2023 has “recently been partially revoked by the Dutch government.”

ASML shares were down about 1% in morning trade.

ASML sells lithography machines that are a key part of the chip manufacturing process. One type of machine they sell is called an extreme ultraviolet (EUV) lithography machine which is used to make the most advanced chips around, such as those that go into an Apple iPhone.

For several years, ASML has been barred from exporting this machine to China. To date, it has not yet shipped a single EUV machine to China.

The second type of tool it sells is called an immersion deep ultraviolet (DUV) lithography machine, which are used to make slightly less advanced chips. The NXT:2050i and NXT:2100i which are caught up in the Dutch government’s latest export curbs are DUV lithography machines.

The revokation of the shipping license comes after the U.S. government tightened export controls on advanced semiconductors and chipmaking tools to China in October, building on previous rules.

ASML said in its statement that in recent discussions with the U.S. government, the company has “obtained further clarification of the scope and impact” of the October updated export controls. These curbs “impose restrictions on certain mid critical DUV immersion lithography systems for a limited number of advanced production facilities.”

The Dutch government, following U.S. pressure, introduced its own curbs in June on the export of advanced semiconductor equipment.

A spokesperson for the Dutch Ministry of Foreign Affairs was not immediately available for comment when contacted by CNBC.

ASML said it does not expect the revocation of its export license of U.S. export controls “to have a material impact on our financial outlook for 2023.”

ASML has previously said that it expects fourth quarter net sales of between 6.7 billion euros ($7.4 billion) and 7.1 billion euros.

Continue Reading

Technology

After 20 years at the helm, Klarna’s CEO Sebastian Siemiatkowski is about to face his biggest test yet

Published

on

By

After 20 years at the helm, Klarna's CEO Sebastian Siemiatkowski is about to face his biggest test yet

Sebastian Siemiatkowski, CEO of Klarna, speaking at a fintech event in London on Monday, April 4, 2022.

Chris Ratcliffe | Bloomberg via Getty Images

LONDON — After 20 years in the role as Klarna’s CEO, Sebastian Siemiatkowski is about to face his toughest test yet as the financial technology firm prepares for its blockbuster debut in New York.

Siemiatkowski, 43, co-founded Klarna in 2005 with fellow Swedish entrepreneurs Niklas Adalberth and Victor Jacobsson with the aim of taking on traditional banks and credit card firms with a more user-friendly online payments experience.

Today, Klarna is synonymous with “buy now, pay later” — a method of payment that allows people to buy things and either defer payment until the end of the month or pay off their purchases over a series of equal, interest-free monthly installments.

But while Siemiatkowski has grown Klarna into a fintech powerhouse, his entrepreneurial journey hasn’t been without its challenges — from facing rising competition from rivals such as PayPal, Affirm and Block‘s Afterpay, to an 85% valuation plunge.

Nevertheless, Siemiatkowski hasn’t taken those challenges lying down and the outspoken co-founder isn’t shy to challenge criticisms in the run up to an IPO that could value it at $15 billion.

‘Crazy enough’

In October 2024, CNBC met with Siamiatkowski during a visit the Swedish entrepreneur made to London. For a businessman who’s faced a rollercoaster ride of ups and downs over his two-year CEO tenure, Klarna’s chief has a calm air to him.

We now have 'a whole generation' of fintechs preparing for IPOs, says QED Investors' Nigel Morris

“Independently of all the cycles and everything we’ve gone through with the company, at any point in time I ask myself, do I still think that Klarna can become the next Google in size, that we can become a hundreds of billions dollar market company, or a trillion dollars,” Siemiatkowski told CNBC. “I still am crazy enough to think that’s achievable.”

Once a pandemic-era darling valued at $46 billion in a SoftBank-led funding round, Klarna saw its valuation plummet 85% in 2022 to $6.7 billion as rising inflation and interest rates dented investor sentiment on high-growth technology firms.

But the firm has attempted to rebuild that eroded value in the years that have followed.

Klarna makes money predominantly from fees it charges merchants for providing its payment services, in addition to income from interest-bearing financing plans and advertising revenue.

Financials disclosed in its IPO filing show that Klarna reported revenue of $2.8 billion last year, up 24% year-over-year, and a net profit of $21 million — up from a net loss of $244 million in 2023.

Bullish on AI

After the launch of OpenAI’s generative AI ChatGPT in November 2022, Siemiatkowski quickly pivoted Klarna’s focus to embracing the technology, and especially in a way that could slash costs and enhance the firm’s profitability.

However, Siemiatkowski’s strategy and his comments on AI have also attracted controversy.

Klarna imposed a freeze on hiring in 2023 as it looked to tighten costs. The following year, the company said that its AI chatbot was doing the work of 700 full-time customer service jobs.

Klarna’s CEO then said in August that his company was able to reduce its overall workforce to 3,800 from 5,000 thanks in part to its application of AI in areas such as marketing and customer service.

“By simply not hiring … the company is kind of becoming smaller and smaller,” he told Reuters news agency, adding that jobs were disappearing due to attrition rather than layoffs.

Asked by CNBC about his views on AI and the upset they have caused, Siemiatkowski suggested he was “done apologizing,” echoing comments from Mark Zuckerberg about the Meta CEO’s “20-year mistake” of taking responsibility for issues for which he believed his company wasn’t to blame.

Doubling down, Siemiatkowski added that AI “already today can do a lot of the jobs that people do — but I don’t want to be one of the tech leaders that stands on a stage and says, ‘Don’t worry about it, there’s going to be new jobs,’ because I don’t know what those new jobs are.”

“I just want to be transparent and honest with what I think is happening, and I’d rather be open about that, because I know what these people, the tech leaders are saying when they’re not on public stages, and they’re not saying the exact same things,” he told CNBC in October.

An outspoken CEO

Siemiatkowski is no stranger to defending his company in response to criticisms, especially when challenged over Klarna’s business model of offering short-term financing for all kinds of things from clothing to online takeout.

Last week, Klarna announced a tie-up with DoorDash to offer its flexible payment options on the U.S. food delivery app. However, the move was met with backlash from internet users, who said it risks saddling struggling consumers with more debt.

One X user posted a meme showing personal finance pundit Dave Ramsey with the caption, “what do you mean you have $11k in ‘doordash debt’.”

Siemiatkowski took to X to defend the move, saying that Klarna “offers many payment methods” including the ability to pay in full instantly or defer payment until the end of the month in addition to monthly installments.

“DoorDash offers many products beyond food!” Klarna’s boss said on X in response to the criticisms. “I know we are most famous for pay in 4. But you can use a credit card at DoorDash as well.”

Klarna CEO defends business model as Apple launches rival product

In 2022, the outspoken entrepreneur stressed his company was “superior” to credit cards and “extremely recession-proof” after the firm laid off 10% of its workforce.

As Klarna approaches its stock market debut, investors will likely be scrutinizing his track record and whether he’s still the right person to lead the company longer term.

Lena Hackelöer, CEO of Stockholm-based fintech startup Brite Payments, is someone who’s worked under Siemiatkowski’s leadership, having worked for the company for seven years between 2010 and 2017 in various marketing functions.

She expressed admiration for the Klarna co-founder — and pushed back on suggestions that leadership mismanaged the business during the pandemic era.

“I never thought that they had mismanaged, which is somehow how it was reported,” Hackelöer told CNBC in a November interview. “I think that they were just very much focusing on growth — because that was the direction that investors were giving.”

Rollercoaster ride

Siemiatkowski admits the journey of building Klarna hasn’t always been rosy.

Asked about the biggest challenge he’s ever faced as CEO, Siemiatkowski said that, for him, laying off 10% of Klarna’s workforce in 2022 was the toughest thing he’s ever had to do.

“That was very difficult because I didn’t predict that investor sentiment would shift that fast and people would go from valuing companies like ours so high and then to something so low,” he said.

“That’s obviously very difficult because, then you realize like, ‘OK, s—, I’m going to have to make a change. It’s not going to be sustainable to continue, and I need to protect the consumers, who are stakeholders in the company, the employees, the investors — I need to [do] what’s right for all of my constituents,” Siemiatkowski continued.

Klarna is synonymous with the “buy now, pay later” trend of making a purchase and deferring payment until the end of the month or paying over interest-free monthly installments.

Nikolas Kokovlis | Nurphoto | Getty Images

I think anyone who is a little bit sane, that’s not something you take light hearted, right? It’s a tough decision. It makes you cry. I’ve cried.

Sebastian Siemiatkowski

CEO, Klarna

The company also onboarded hundreds of new employees to capitalize and expand on the opportunity it saw from government lockdowns’ impact on consumer behavior and the broader acceleration of e-commerce adoption at that time.

“I think anyone who is a little bit sane, that’s not something you take lighthearted, right?” Klarna’s CEO said, referring to the layoffs. “It’s a tough decision. It makes you cry. I’ve cried.”

However, Siemiatkowski stood by his decision to lay off workers: “I felt like I had an obligation to my constituents, everyone, all of these stakeholders, the company, and I think it was a necessary decision at that point in time.”

The road to IPO

Now, Klarna’s CEO faces his biggest test yet — taking the business he co-founded two decades ago public.

“IPOs are risky for companies as share prices can fluctuate quickly,” Nalin Patel, director of EMEA private capital research at PitchBook, told CNBC via email. “They can be costly and lengthy to arrange with investment banks too.”

Affirm CEO: We're a replacement for credit cards, not debit cards

Klarna earlier this month filed its prospectus to list on the New York Stock Exchange. The company hasn’t yet set a date for when it will go public, nor has it priced shares.

If it succeeds, the outcome could catapult the net worth of Siemiatkowski and other shareholders including Sequoia Capital, Silver Lake, Mubadala Investment Company, and the Canada Pension Plan Investment Board.

Sequoia is Klarna’s single-largest shareholder with a 22% stake. Siemiatkowski is the second-largest, owning 7% of the business.

A positive IPO outcome would also lift the value of Klarna employees’ stakes, and potentially boost morale after a turbulent few years for the company.

“It’s a balance between finding a fair value for existing investors looking to cash out and new investors seeking a stake in Klarna at a fair price. Overvaluing the company could lead to its valuation falling in the future. While undervaluing it may mean money has been left on the table for those exiting,” Patel said.

Continue Reading

Technology

In Trump era, companies are rebranding DEI efforts, not giving up

Published

on

By

In Trump era, companies are rebranding DEI efforts, not giving up

Sundar Pichai, CEO of Google and Alphabet, attends the inauguration of a new hub in France dedicated to the artificial intelligence sector, at the Google France headquarters in Paris, France, on Feb. 15, 2024.

Gonzalo Fuentes | Reuters

After Google scrapped its diversity, equity and inclusion, or DEI, hiring aspirations in February, CEO Sundar Pichai addressed the matter with his employees at a company all-hands meeting. 

“We believe in building a representative workforce,” Pichai said, according to audio obtained by CNBC. “We’re a global company, we have users around the world, and we think the best way to serve them well is by having a workforce that represents that diversity, and we’ll continue to do that.”

“At the same time, as a company we will always have to comply with local laws,” Pichai added. 

Among the most notable changes by Google thus far was with Melonie Parker, the company’s chief diversity officer. As of February, her title has been changed to vice president of Googler engagement.

Google’s approach to DEI is emblematic of changes that companies across the U.S. are making to their DEI programs in the wake of President Donald Trump’s election and initial actions in his return to the White House. 

Over the past decade, Silicon Valley and other industries used DEI programs to root out bias in hiring, promote fairness in the workplace and advance the careers of women and people of color – demographics that have historically been overlooked.

While DEI started as an umbrella acronym to even the playing field, it’s become a loaded term.

In 2023, the Supreme Court ruled against Harvard University’s affirmative action admission policies – a decision that had implications for how corporations hire. In one of his first acts of his second term, President Donald Trump signed an executive order in January to end the government’s DEI programs and put federal officials overseeing those initiatives on leave.

The order directs “all departments and agencies to take strong action to end private sector DEI discrimination, including civil compliance investigations.” The administration has targeted nearly 50 companies that it’s deemed to be in violation of its anti-DEI rules, Bloomberg reported in February.

Among the first of those targets is the Walt Disney Company. The Federal Communications Commission informed the company on Friday that it will begin an investigation into the DEI efforts at the media giant.

Trump has shown he’s willing to fault DEI policies for human tragedy.

Following a midair collision between an American Airlines regional jet and a Black Hawk military helicopter above Washington in January, Trump blasted the Biden administration’s DEI policies for the crash without citing any evidence. Trump claimed DEI “could have been” to blame for the deadliest plane crash in the U.S. since 2001.

“When you have the president blaming DEI for a plane crash, I think it makes sense that companies don’t want to be out there no matter how they define it internally,” Emerson said.

Despite DEI becoming such a divisive term, companies are not necessarily ending their efforts. They’re rebranding them. Many companies are continuing DEI work but using different language or rolling it under less charged terminology, like “learning” or “hiring.”

Paradigm’s CEO Joelle Emerson is an advocate for diversity and inclusion.

Source: Paradigm

DEI by any other name

Joelle Emerson has worked since 2014 as a consultant for several hundred clients on workplace performance as well as diversity and inclusion strategies, but last year, she changed the language used to describe her digital platform Paradigm.

Whereas before Paradigm marketed itself as helping clients “harness the power of diversity and inclusion to create a culture where everyone can do their best work and thrive,” the company’s website now states that its solutions “create an inclusive, high-performance culture where everyone can do their best work and thrive.”

Paradigm began using DEI in 2020 after the term proliferated in the corporate response to protests across the country in the wake of George Floyd’s death. 

“We started using that a lot on our websites so that companies searching for ‘DEI’ could find us,” Emerson told CNBC. “Pre-election, as we were seeing a lot of the backlash, we reduced our use of the acronym because I didn’t think it would be the best description of what we do.”

Devika Brij, who does similar work through her Brij The Gap consulting firm, detailed her efforts to distinguish her work in a newsletter sent out in February titled “Tailored Career and Leadership Development Isn’t DEI.” For companies like Brij’s, the re-branding is critical to the future of their business – some of Brij’s clients have slashed their DEI budgets by as much as 90% since 2023, she said at the time. 

It’s not just consulting firms that are rebranding DEI. 

JPMorgan in March announced that it will replace “equity” with “opportunity” in a rebrand of its DEI program. Walmart in November said it was shifting from DEI to saying “Walmart for everyone.” Among Fortune 100 companies, there was a 22% decrease in the use of terms like “DEI” and “diversity” and a 59% increase in terms like “belonging” between 2023 and 2024, according to Paradigm. 

Google kills diversity hiring targets, reviewing other DEI programs

Emerson said 2023 marked the turning point for DEI in Silicon Valley. 

That’s when Google began getting rid of staffers who were in charge of recruiting people from underrepresented groups, CNBC reported. The company also let go of DEI leaders under Parker.

Amazon also reorganized its DEI group in 2023 and brought global teams under one umbrella named “Inclusive Experiences & Technology.” The company renamed the group to better represent the nature of the work, a company spokesperson told CNBC, adding that Amazon remains committed to building a diverse and inclusive company.

As part of that overhaul, Amazon’s Candi Castleberry changed her vice president title from “VP of Global Diversity Equity and Inclusion” to “VP of Inclusive Experiences & Technology.”

Tech’s DEI rollback has accelerated in 2025. 

Google, which has cloud-computing contracts with federal agencies, announced in February that it would retire its aspirational hiring targets following Trump’s executive orders. Google’s commitments for 2025 had included increasing the number of people from underrepresented groups in leadership by 30% and more than doubling the number of Black workers at non-senior levels.

“Our values are enduring, but we have to comply with legal directions depending on how they evolve,” Pichai told staffers at the February all-hands meeting.

He and Parker were answering a question from staffers about how the company’s DEI programs would be impacted given Trump’s recent executive orders.

“As a federal contractor, we have been reviewing all our programs, all our initiatives,” Parker said. “With regards to training, we’re going to deprecate, or stop or sunset, a number of our training programs that are focused on DEI.”

A spokesperson for Google did not clarify which of the company’s DEI programs have been cut.

Pichai went on to assure workers that Google would continue to support its employee resource groups. Those are employee-led networks within the company that focus on specific demographic or affinity groups, such as “Women@Google” and “Black Googler Network.”

Those comments, however, came before the Equality Employment Opportunity Commission published guidance in March that listed ERGs as a potential violation of Trump’s executive order if they are exclusionary. Google’s ERGs are open to all employees and do not exclude any protected groups, the company spokesperson told CNBC.

“Based on the current legal climate, we’re reviewing our DEI programs and making changes where needed,” the Google spokesperson said in a statement.

Melonie Parker speaks on stage during The 37th Annual Hispanic Heritage Awards at The Kennedy Center on Sept. 5, 2024 in Washington, DC. 

Paul Morigi | Getty Images

The sensitivity of the term DEI came to the forefront earlier this month at Austin’s annual South by Southwest conference. There, Google and Oracle had been slated to participate in a panel, originally titled “Successful Workplaces: Balancing Growth and Well-Being.” 

“Attendees will leave with actionable insights to align business success with a thriving workplace culture,” an early description of the panel noted. 

Oracle dropped out from the panel in February. That month, panel organizers informed participating companies that they were considering changing the focus of the conversation to the state of DEI in the workplace.

“The fact that the Trump administration took such an aggressive approach to DEI just made obvious, in our view, how timely this discussion was,” said panel organizer Luis Gramajo, founder of nonprofit Sunday Afternoon Foundation, which helped organize that particular SXSW panel.

The Google panelist dropped out in March after the panel’s name was officially changed to “Post-DEI Workplace: Tech Companies Managing Through Turmoil.”

“We went through I don’t know how many prep calls, we changed the title of this eight plus times, we lost people who were afraid to be on this panel,” said Chelsea Toler, one of the SXSW panelists and a co-founder at Logictry, an Austin startup.

Google was not informed of the change until late February, the company spokesperson told CNBC, adding that the panel’s new topic was outside of the employee’s role and experience.

“We had a couple different panelists back out because this conversation, which is so important, has become kind of nuclear at this point, which is wild,” said Diana Ransom, Inc. Magazine executive editor and the panel’s moderator, at the event.

Gramajo said he doesn’t begrudge any of the panelists or companies that pulled out of the panel.

“They are, as we all are, navigating an incredibly complex and uncertain time, where the rules are not clear,” he said.

Amazon CEO Andy Jassy looks on during an Amazon Devices launch event in New York City, U.S., February 26, 2025. 

Brendan McDermid | Reuters

Amazon has also pulled back on DEI. 

The company told staffers in December that it was halting some of its DEI programs as part of a broader review of those initiatives. It also eliminated references to inclusion and diversity in its annual report while altering a website to remove sections titled “Equity for Black people” and “LGBTQ+ rights.” 

Amazon CEO Andy Jassy characterized the DEI eliminations as being part of Amazon’s ongoing cost-cutting efforts

“If you look at us, kind of like a lot of other companies, particularly after George Floyd, and particularly because we’re so decentralized, we had a lot of programs in this area,” Jassy told staffers earlier this month, according to audio obtained by CNBC. “We had about 300 programs.” 

Amazon began evaluating its DEI programs “a couple years ago,” Jassy said. 

“We realized there were several of them where we weren’t getting enough value out of them for us to be investing in that way and those programs, we streamlined those,” Jassy said. “And in the programs where we were having a real impact, we doubled down.”

It’s unclear which programs Amazon cut and which it has expanded. 

Continuing the work

“The acronym of DEI is completely unhelpful,” said Aubrey Blanche-Serrallano, vice president of equitable operations at Culture Amp, a human resources platform. “Diversity is incredibly valuable and important, but that specific acronym obscures a lot of what we’re talking about.” 

For all the backlash toward DEI in Washington, recent studies show that this type of work remains popular among workers and companies. 

Pew Research in 2023 found that 86% of workers say they have a neutral-to-favorable opinion about increasing diversity, equity, and inclusion in the workplace. Paradigm, meanwhile, published a study last year which found that 73% of companies included diversity, equity  and inclusion in their company values, on par with 2023.

“The feeling of the moment doesn’t match a lot of the data I’m looking at,” Blanche-Sarellano said. 

The experts that spoke with CNBC said they’ve yet to lose any clients as a result of the DEI backlash. To the contrary, they said they are optimistic that organizations will be forced to be more thoughtful about their plans and do away with “performative” aspects of DEI that did little to move the needle.

Experts said one key example of performative actions were when companies signaled support for social media movements, like 2020’s Blackout Tuesday, without any meaningful action to follow. Another example were companies that added chief diversity officers to their ranks without giving them formalized decision-making power or budgets.

Among the changes happening now are companies shifting away from diversity reports, which tracked hiring based on different genders and ethnicities, and focusing instead on tracking the rates at which promotions and attrition happen, Emerson said. 

Companies are also changing how they have candidates apply for programs, Emerson said. With internships designed for specific ethnicities, for example, candidates might no longer simply check whether they are black or Hispanic but instead write an essay about their background, she said. 

Some experts are helping their clients calculate how much risk they may face by continuing DEI work under different names.

“There’s a lot of legal gray area right now,” Blanche-Sarellano said. “At the end of the day, they want to focus on investing in their employees, not spend all their resources on a lawsuit.”

Y-Vonne Hutchinson, chief executive officer of ReadySet, speaks during the Bloomberg Breakaway CEO Summit in New York, U.S., on Tuesday, June 18, 2019. 

Mark Kauzlarich | Bloomberg | Getty Images

Companies have to weigh the risk of regulatory compliance and the potential for public backlash against the cost of doubling down on DEI, said Y-Vonne Hutchinson, founder of ReadySet, a firm that helps clients “build adaptable organizations.”

“A lot of these companies have more diverse consumers,” she said. “They still have to think about what is going to make them money and viable businesses have to think about a global audience.”

ReadySet, for example, has what it calls a “DEI Risk Assessment Tool” which measures DEI risks across five dimensions: Legal and compliance, reputational, financial, cultural and workforce and operational risks. 

By changing the terminology that is used, companies can prevent their work from being susceptible to misunderstanding, said Emerson, adding that her firm Paradigm is advising companies to be more specific about what they want to achieve.

“We should be more precise in the language we use,” she said. 

But while some experts are encouraging companies to change their terminologies, others are advising those in the field to continue touting DEI. 

That was the case at the Post-DEI panel at SXSW. The panelists challenged the notion that they should stop using it.

“DEI means everybody has a fair and equitable opportunity to succeed,” said Fran Harris, an entrepreneur based in Austin. “We have to remind people what DEI is – it is the work. It’s not just an acronym. It’s the work of creating equal opportunities, period.”

Panelists encouraged attendees to not succumb to fear.

“In this country, when we stop using our voice because we’re scared, we’ve lost,” Logictry’s Toler said.

Continue Reading

Technology

23andMe bankruptcy: With America’s DNA put on sale, market panic gets a new form of testing

Published

on

By

23andMe bankruptcy: With America's DNA put on sale, market panic gets a new form of testing

Signage at 23andMe headquarters in Sunnyvale, California, U.S., on Wednesday, Jan. 27, 2021.

David Paul Morris | Bloomberg | Getty Images

DNA testing has become a valuable tool for hobbyists and novice genealogists. For some, learning they are the 10th cousin of Paul Revere or the 15th great nephew four times removed of the last King of Prussia is worth the perceived risk of sharing a DNA sample. But what happens when the company harvesting the DNA goes bankrupt? 

That was the question posed to millions of Americans last week when 23andMe, the company that popularized consumer genetic testing and had early backing from Google, filed for bankruptcy, leading to a wave of calls for Americans to delete their DNA from the company’s database.

While it’s not 100 percent clear if the “delete your DNA” calls were warranted, privacy experts are alarmed, and Americans who had taken the genetic test took the advice to heart.

According to data from online traffic analysis company Similarweb, on March 24, the day of the bankruptcy announcement, 23andMe received 1.5 million visits to its website, a 526% increase from one day prior. According to Similarweb, 376,000 visits were made to help pages specifically related to deleting data, and 30,000 were made to the customer care page for account closure. The next day, that figure rose to 1.7 million visits, and rraffic to the delete data help page about 480,000.

Margaret Hu, professor of law and director of the Digital Democracy Lab at William & Mary Law School, thinks Americans made the right move. “This development is a disaster for data privacy,” said Hu. In her view, the 23andMe bankruptcy should serve as a warning as to why the federal government needs strong data protection laws.

In some states, Hu noted, the government is taking an active role in counseling consumers. The California Attorney General’s Office is urging Californians to delete their data and have 23andMe destroy saliva samples. But Hu says that is not enough, and such guidance should be provided to all U.S. citizens.

The potential national security implications of 23andMe’s data falling into the wrong hands are not new. In fact, the Pentagon had previously warned military personnel that these DNA kits could pose a risk to national security.

Exposing DNA collected from consumers is not a new issue for 23andMe, either. In 2023, almost 7 million people who took the genetic test were already exposed in a major 23andMe data breach. The company signed an agreement that involved a $30 million settlement and a promise of three years’ worth of security monitoring.

But Hu says the bankruptcy does make the company, and its data, especially vulnerable now.

Drug research and genetic testing data

One of the things notable about the consumer mindset in the early years of the popularization of genetic testing was that a majority of users opted into sharing their DNA for research purposes, as much as 80% in the years when 23andMe was growing rapidly. Then, as the market for consumer sale of the popular DNA test kits reached saturation sooner than many expected, 23andMe focused more on research and development partnerships with drug companies as a way to diversify its revenue.

Currently, when 23andMe sells genetic data to other research companies, most is used at an aggregate level, as part of millions of data points being analyzed as a whole. The company also strips out identifying data from the genetic data, and no registration information (like a name or email) is included. Data researchers do need, such as date of birth, is stored separately from genetic data, and shared with randomly assigned IDs.

Hu is among the experts concerned these practices could change under 23andMe or any new buyer. “In a time of financial vulnerability, companies such as pharmaceutical companies might see an opportunity to exploit the research benefits of the genetic data,” Hu said, adding that they might try to renegotiate prior contracts to extract more data from the company. “Will the next company that buys 23andMe do that?,” Hu said of its privacy policies.

In recent days, 23andMe has said it will try to find a buyer who shares its privacy values.

23andMe did not respond to a request for comment.

Anne Wojcicki, 23andMe Co-Founder & CEO pushes the button, remotely ringing the NASDAQ opening bell at the headquarters of DNA tech company 23andMe in Sunnyvale, California, U.S., June 17, 2021.

Peter DaSilva | Reuters

Over the years since 23andMe’s founding in 2006, many customers were willing to send in a swab to learn more about their family history. Lansing, Michigan resident Elaine Brockhaus, 70, and her family were excited to learn more about their lineage when they submitted samples of their DNA to 23andMe. But with the company now teetering in bankruptcy and privacy experts concerned about what happens to the millions of people with DNA samples stored, Brockhaus says the whole thing has “caused a bit of a ruckus in my family.”  

“We enjoyed some aspects of 23&Me,” Brockhaus said. “They continually refined and updated our heritage as more people joined, and they were better able to pinpoint genetically related groups,” Brockhaus said. She was able to learn more about health risk factors that were present or not present in her past.

Now, her family has come full circle in the 23andMe experience: some members were initially reluctant to go along, and now, Brockhaus says, everyone has deleted their accounts.

A unique company collapse, but everyday cyber risks

But Brockhaus continues to view 23andMe within a larger consumer health market where the risks are not new, and health information is being shared in all sorts of environments where security issues could arise. “Anyone sending ColoGuard or receiving medical results through the mail is taking a risk of exposure,” Brockhaus said. “Our very identities can be stolen with a few keystrokes. Of course, this does not mean that we should throw up our hands and agree to be victims, but unless we want to dig holes out back and live in them we have to be vigilant, proactive, but not panicked,” she added.

Jon Clay, vice president of threat intelligence at cybersecurity firm Trend Micro, says consumers of 23andMe do need to view the bankruptcy as a threat. In any sale process, if the data is not transferred and guarded in the most secure manner possible, “it is at risk of being used by malicious actors for a number of nefarious purposes,” he said.

Clay thinks 23andMe’s data is incredibly valuable to cybercriminals — not just because it’s permanent and personally identifiable, but also because it can be exploited for identity theft, blackmail, or even medical fraud.

“Cybercriminals can use it to target consumers with convincing scams and social engineering tactics, such as fraudulently claiming someone is a blood relative to another person or to send deceptive messages about their potential health risks,” Clay said. “Organizations who go bankrupt should ensure the security and privacy of their customer’s data is critical, and any sharing or selling of data to others should not be done,” he added.

But other experts say the lesson of 23andMe is less about the company’s collapse and the threat to privacy that created than serving as a reminder about the everyday cyber hazards related to personal information.

“When people start talking about personal data, they forget where their data is already sitting,” says Rob Lee, chief of research and head of faculty at SANS Institute, which specializes in helping businesses with information security and cyber issues. Whether it’s sending a blood sample into a private lab or getting rid of a laptop to upgrade to a new one, “your digital footprints are being left out there for people to find,” Lee said. “People don’t understand the scope, so there is a larger discussion out there, specifically around where does data go?”

With DNA information, there are certain basic legal factors people should weigh before swabbing themselves and sending the sample in.

According to Lynn Sessions, an expert on healthcare privacy and digital assets and partner at the law firm BakerHostetler, the federal law that covers patient information privacy, HIPAA, does not apply to this situation, and 23andMe would not be considered a HIPAA-covered entity, or business associate of one. But there are state laws that apply to genetic information that would be in play, such as in California.

Meredith Schnur, a managing director and cybersecurity leader at insurance company Marsh, thinks the risk from 23andMe’s bankruptcy for people who sent in their swabs is relatively low. “It doesn’t cause any additional consternation or heartburn,” Schnur said. “I just don’t think it opens up any additional risk that doesn’t already exist,” she said, adding that many people’s information is “already out there.”

Last week, a 23andMe co-founder, Linda Avey, blasted the company’s leadership. “Without continued consumer-focused product development, and without governance, 23andMe lost its way, and society missed a key opportunity in furthering the idea of personalized health,” Avey wrote in a social media post. “There are many cautionary tales buried in the 23andMe story,” Avey said.

The bankruptcy itself is the issue that is now hard for consumers to ignore, and until the sale process is completed, the questions will remain.

“When you’re in bankruptcy, data privacy values are not what you’re really thinking about. You’re thinking about selling your company to the highest bidder,” Hu said. That highest bidder, Hu says might take the genetic data and consumer profile data and link them together when selling it to others.

And that initial sale which includes the DNA of millions of people may only be the first of many transactions.

“It might sell it off, piece by piece, indiscriminately. And the buyer of that data might be a foreign adversary,” Hu said. “That is why this is not just a data privacy disaster. It’s also a national security disaster.”

We don't know who could buy 23andMe data and how it could be used against us, says Theresa Payton

Continue Reading

Trending