Genetic testing firm 23andMe has agreed to an $18 million settlement with a coalition of 42 U.S. attorneys general following a data breach that occurred in October 2023. The settlement, announced by New York Attorney General Letitia James, also imposes new data protection requirements on the company. New York will receive over $705,000 from the settlement.
The 2023 incident, which 23andMe confirmed, involved cybercriminals accessing customer profile information through a credential stuffing campaign. At the time, the company stated that its own network had not been infiltrated, attributing the breach to customers' poor password management and lack of multi-factor authentication (MFA). Information belonging to over six million individuals, including ancestry data, was accessed.
The settlement mandates several new security measures for 23andMe, including appropriate risk analysis, the establishment of an Advisory Board focused on data security, and the continued right for consumers to delete their information.
In March 2025, 23andMe filed for bankruptcy protection. During the bankruptcy proceedings, Attorney General James and a bipartisan coalition of 27 attorneys general sued 23andMe to safeguard genetic information. As a result of the bankruptcy, 23andMe's customer data was sold to TTAM Research, a non-profit founded by 23andMe's founder and former CEO, Anne Wojcicki. The coalition has also secured new information and data security requirements at TTAM Research to protect customer data and prevent future breaches.
This $18 million settlement is in addition to a $46.75 million settlement approved by a U.S. bankruptcy judge on July 7, intended as compensation for victims of the data breach. However, on July 10, a bankruptcy judge ruled that California could not seek damages from 23andMe due to its Chapter 11 reorganization plan. California was given 14 days to either dismiss its May 28 lawsuit, filed by Attorney General Rob Bonta, or amend the complaint to remove claims for monetary relief.
Internationally, 23andMe has also faced penalties. In July 2026, the Spanish privacy watchdog fined the company 2.4 million euros (approximately $2.75 million) because 2,642 Spanish customers were affected by the breach. In June 2025, the UK's Information Commissioner's Office fined 23andMe 2.3 million pounds (approximately $3.1 million) for failing to protect customers' special category data.
