Genetic testing company 23andMe has filed for bankruptcy, leaving millions of customers wondering what will happen to their DNA data. Alongside the bankruptcy announcement, co-founder and CEO Anne Wojcicki has resigned.

The company plans to sell “substantially all of its assets,” though it hasn’t confirmed whether there are any buyers. Despite financial struggles, 23andMe says it will continue operations, and customers can still access their data and use testing kits as usual.

However, privacy concerns are growing. 23andMe’s updated privacy policy states that in the event of a sale, “your Personal Information may be accessed, sold, or transferred.” This means a new owner could gain control of customer data, raising fears about how it might be used.

Regulators have taken notice. California Attorney General Rob Bonta urged users to consider deleting their data.

“Given 23andMe’s reported financial distress, I remind Californians to consider invoking their rights and directing 23andMe to delete their data,” he said.

Cybersecurity experts warn that the company may be more vulnerable to hackers as it struggles financially.

“They’re probably not in as good a position to repel an attack,” said Toronto lawyer Brent Arnold.

Customers can request to delete their data, but 23andMe states it may retain some genetic information due to legal requirements. Privacy advocates warn that once data has been used for research or shared in past transactions, it may be impossible to fully erase.