23andMe Pays $18M to 42 States Over 2023 Genetic Data Breach
Multistate settlement finalizes during bankruptcy proceedings after hackers accessed 6.9 million users' DNA profiles.
Forty-two state attorneys general and the District of Columbia secured an $18 million settlement with 23andMe over a 2023 data breach that exposed the genetic information of approximately 6.9 million users, state attorney general offices announced in July 2026.
Breach Exposed Immutable Genetic Data
The breach occurred in October 2023, when attackers used credential stuffing to access user accounts through the company's 'DNA Relatives' and 'Family Tree' features, the Utah Attorney General's office stated. Compromised data included identifying information, ancestry details, and genetic profiles.
Unlike passwords or credit card numbers, genetic profiles cannot be changed once exposed. This permanence makes genetic data breaches particularly consequential for affected users, privacy advocates note.
"23andMe failed its customers—it did not do enough to protect them, and their most sensitive, private information," the Utah Attorney General's Office said in a statement. "This breach of trust is unacceptable."
Settlement Finalized During Bankruptcy
The multistate agreement was finalized following 23andMe's March 2025 bankruptcy filing. State attorneys general pushed for stricter controls on genetic data handling even as the company sought bankruptcy protection.
The $18 million settlement represents one of several legal challenges stemming from the breach. Sources vary on the exact number of participating states, with some citing 42 states plus DC and others reporting 43 states. The Utah Attorney General's office led the coalition.
Broader Implications for Genetic Privacy
The settlement underscores the legal and financial liabilities companies face when failing to protect highly sensitive biological data. It also highlights the role of state attorneys general in enforcing data privacy standards during corporate bankruptcy proceedings.
23andMe, once a leader in consumer genetic analysis, saw its financial stability deteriorate following the breach and subsequent legal challenges. The company's bankruptcy filing in March 2025 marked a dramatic fall for the pioneer in direct-to-consumer DNA testing.
The agreement requires 23andMe to implement enhanced data protection measures, though specific terms beyond the monetary settlement were not detailed in the attorney general announcements.