"Our investigation found that the company failed to take basic steps to protect users' data," said Bonta, who added 23andMe "lied to consumers about the severity of its 2023 data breach."