23andMe settles multistate data breach lawsuit for $18M

Genetic testing company 23andMe agreed to pay $18 million to resolve a multistate data breach lawsuit stemming from a massive 2023 data breach that affected nearly 7 million individuals worldwide. In addition to the monetary settlement, 23andMe will be required to implement new data protection controls to safeguard customer data.

In October 2023, 23andMe fell victim to a cyberattack involving credential stuffing, a tactic in which hackers use stolen login credentials from one account to access other accounts with the same passwords.

The breach exposed ancestry and family tree information, as well as some health information derived from a user's genetics. The information was later listed for sale on the dark web.

The multistate investigation, which included participation from the attorneys general in New York, Texas, Illinois, Massachusetts and more, alleged that 23andMe failed to take critical security measures to protect customer data, including using rate limiting and intrusion prevention, fixing known vulnerabilities and investigating unusual login patterns.

The company looks different from how it did when the breach occurred in 2023. After it filed for Chapter 11 bankruptcy in March 2025, the company's customer data was sold to TTAM Research, a nonprofit founded by 23andMe co-founder Anne Wojcicki.

Since 23andMe has a different operating structure, the attorneys general ensured that new information and data security requirements would apply to TTAM, which is now registered as 23andMe Research Institute. Under the terms of the settlement, the organization must conduct appropriate risk analyses, establish an advisory board on data security and continue to offer customers the right to delete their information.

California was notably absent from the multistate settlement since it chose to file its own lawsuit in May 2026. However, in July, a bankruptcy judge ruled that California could not seek monetary damages from 23andMe because the company's Chapter 11 reorganization plan prevents the state from doing so.

The $18 million secured in the multistate settlement will be paid to states immediately from available bankruptcy funds.

23andMe also previously agreed to a $46.75 million class-action settlement for impacted U.S. customers, which a court approved in January 2026.

Jill Hughes has covered health tech news since 2021. Her coverage areas include cybersecurity, HIPAA compliance, interoperability, AI and EHRs.