Forty-two states will receive $18 million from the bankruptcy funds of 23andMe under a settlement with a coalition of attorneys general announced Tuesday to resolve charges from a 2023 data breach that compromised the genetic data of its customers.
“23andMe presented itself as a safe steward of Washingtonians’ most sensitive personal data and then failed to ensure protection against hackers,” Washington State Attorney General Nick Brown said in a statement.
In October 2023, 23andMe, a direct-to-consumer genetic testing company, announced it had discovered a data breach that affected 6.9 million of its consumers. The breach exposed a wide range of data about 23andMe customers, including in genetic ancestry information, and parts of this data were published for sale on the dark web.
23andMe learned about the breach months after personal information was publicly available.
The company initially denied the breach, then “blamed consumers” for how their accounts were set up and how their passwords were used.
After the data breach, the attorneys general formed an investigation and found that 23andMe used in poor data security practices, including failing to:
- Employ safeguards against credential stuffing attacks, including comparing passwords against lists of known breached passwords or requiring multifactor authentication.
- Carry out intrusion prevention.
- Implement tools likely to detect a data breach.
- Investigate unusual login patterns, for example, a massive spike in login attempts.
- Fix known problems.
- Review and test design features.
In March 2025, 23andMe filed for bankruptcy protection, and the states then filed claims related to the data breach investigation. As part of the bankruptcy proceedings, the assets – including 23andMe’s consumer data – were sold to TTAM Research Institute, a non-profit formed by 23andMe founder and former CEO Anne Wojcicki.
The terms of the sale included information and data security requirements such as enhanced data security requirements, appropriate risk analysis, the addition of an advisory board, agreeing to be bound by privacy laws, and continuing to offer consumer deletion rights.
These terms will make sure that TTAM Research Institute, now reregistered as 23andMe Research Institute, will be a safer custodian of genetic data, Brown said.
In a separate action, 23andMe also agreed to a $46.8 million class-action settlement in the bankruptcy to provide a payment to affected U.S. consumers who submitted claims by Feb. 17, 2026,
