Multistate Settlement Reached in 23andMe Data Breach Bankruptcy Case

BALTIMORE, MD – Maryland Attorney General Anthony G. Brown announced a significant multistate settlement resolving claims against the genetic testing company 23andMe, following a 2023 data breach that exposed the genetic information of approximately 6.9 million individuals globally. The settlement was negotiated with the Office of the United States Bankruptcy Trustee, as 23andMe filed for bankruptcy protection in March 2025. Due to the limited funds available within the bankruptcy estate and the multitude of competing claims, the settlement will provide $18 million, to be disbursed from the existing bankruptcy funds.

This agreement addresses concerns that 23andMe failed to adequately protect the highly sensitive genetic and ancestry data entrusted to it by consumers. The breach, which came to light in October 2023, affected a substantial number of individuals, including nearly 95,000 Maryland residents. The compromised data, which varied in scope per customer, included genetic ancestry information, and subsets of this data were later found for sale on the dark web. Investigations revealed that 23andMe became aware of the breach months after the affected personal information was already circulating externally.

The company’s initial response to the breach drew criticism, as it reportedly declined responsibility and attributed the security lapse to consumers mishandling their passwords. Evidence later indicated that the breach was linked to credentials compromised in a prior incident on MyHeritage.com, a partner website that shared user credentials with 23andMe. A multistate investigation by the attorneys general concluded that 23andMe engaged in a pattern of unreasonable data security practices. These included a failure to implement safeguards against credential stuffing attacks, such as using blocklists for known breached passwords or requiring multi-factor authentication. The company also reportedly lacked appropriate rate limiting or intrusion prevention measures, as well as sufficient logging and monitoring tools to detect a breach. Furthermore, 23andMe did not adequately investigate or address unusual login patterns, including a significant surge in login attempts, nor did it remediate known vulnerabilities or properly test its design features.

Following 23andMe’s bankruptcy filing in March 2025, state attorneys general formally submitted claims related to the data breach investigation. As part of the bankruptcy proceedings, key assets, including 23andMe’s consumer data, were acquired by TTAM Research Institute, a non-profit organization established by 23andMe’s founder and former CEO, Anne Wojcicki. The attorneys general successfully negotiated terms for this sale that incorporate crucial data security requirements. These provisions aim to address the security concerns that led to the breach. The agreement mandates enhanced data security measures, comprehensive risk analysis, the establishment of an Advisory Board, and a commitment to adhere to stringent privacy laws without exception. Additionally, the terms include an agreement to provide consumers with deletion rights for their data. These measures are designed to ensure that the TTAM Research Institute, now re-registered as 23andMe Research Institute, will serve as a more secure custodian of genetic data moving forward.

Beyond general consumer protection principles, Maryland residents are also protected under the state’s specific genetic privacy law. This legislation imposes regulations on direct-to-consumer genetic testing companies, requiring them to maintain transparent privacy policies, obtain explicit consent for the collection or sharing of genetic data, and uphold consumers’ rights to access and delete their information. The settlement was joined by the attorneys general of Alaska, Alabama, Arkansas, Arizona, Colorado, Connecticut, Delaware, the District of Columbia, Florida, Georgia, Idaho, Iowa, Illinois, Indiana, Kansas, Kentucky, Louisiana, Massachusetts, Maine, Michigan, Minnesota, New Hampshire, New Jersey, New Mexico, New York, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, South Carolina, South Dakota, Tennessee, Texas, Utah, Virginia, Vermont, Washington, Wisconsin, and West Virginia.

Article by Mel Anara, based upon information from the Maryland Attorney General’s Office.

Video Spotlight