A bipartisan coalition of 43 attorneys general has secured an $18 million settlement from genetic testing company 23andMe for failing to protect the private genetic data of millions of customers, the Utah Attorney General's office and the New York Attorney General's office announced in July 2026.
The settlement follows a massive data breach discovered in October 2023 that exposed the sensitive information of 6.9 million consumers, including genetic ancestry details, and led to the company filing for bankruptcy protection in March 2025.
Security Failures and Dark Web Exposure
The multi-state action, which included Utah and New York, addresses failures in 23andMe's security protocols that allowed customer information to be stolen and subsequently listed for sale on the dark web. According to the New York Attorney General's office, the company learned of the breach months after the impacted personal information had already been made publicly available.
New York Attorney General Letitia James stated that the company put millions of customers at risk through flimsy security measures. James noted that while companies have a duty to protect personal information from hackers, 23andMe failed to meet those obligations, leaving New Yorkers' sensitive genetic data vulnerable to theft and identity theft.
Investigation Uncovers Security Gaps
A multistate investigation conducted by the coalition revealed that 23andMe failed to implement several critical security safeguards. These failures included a lack of safeguards against cyber-attacks using stolen credentials, such as comparing passwords against blocklists of known breached passwords or requiring multifactor authentication.
Investigators also found that the company lacked appropriate rate limiting or intrusion prevention measures. Furthermore, the company failed to utilize proper logging, monitoring, or other tools likely to detect a data breach. The investigation also highlighted a failure to investigate unusual login patterns, such as massive spikes in login attempts, and a failure to fix known vulnerabilities or properly test design features.
Bankruptcy and Data Transfer
The legal battle intensified during 23andMe's financial restructuring. The company filed for bankruptcy protection in March 2025, prompting Attorney General James and a bipartisan coalition of 27 other attorneys general to file claims and sue the company in June 2025 to protect Americans' personal genetic information during the bankruptcy proceedings.
As a result of the bankruptcy, 23andMe's customer data was sold to TTAM Research (TTAM), a non-profit organization formed by 23andMe's founder and former CEO. TTAM has since re-registered as the 23andMe Research Institute.
New Protections for Genetic Data
To prevent future breaches, the settlement imposes new, strict data security requirements on the 23andMe Research Institute. These new mandates include the implementation of appropriate risk analysis and the addition of an Advisory Board on data security.
Additionally, the settlement ensures that consumers retain the right to delete their information. These measures are intended to ensure that the new entity serves as a safer custodian of genetic data moving forward.
Multistate Coalition Details
The $18 million settlement was joined by attorneys general from a wide range of states, including Alabama, Alaska, Arizona, Arkansas, Colorado, Connecticut, Delaware, Florida, Georgia, Idaho, Illinois, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, North Carolina, North Dakota, New Hampshire, New Jersey, New Mexico, Ohio, Oklahoma, Oregon, Pennsylvania, South Carolina, South Dakota, Tennessee, Texas, Utah, Virginia, Vermont, Washington, Wisconsin, West Virginia, and the District of Columbia.
In addition to the multistate settlement, 23andMe will pay more than $705,000 specifically to the state of New York.
Conclusion
The settlement marks a significant victory for consumer privacy advocates seeking to hold genetic testing companies accountable for the protection of highly sensitive biological information.
