Penalty Amount
$18,000,000
Consumers Affected
6,900,000
Attorney General William Tong led a coalition of 42 attorneys general in a settlement with the bankruptcy trustee for 23andMe, resolving allegations from a 2023 data breach that compromised the genetic data of 6.9 million customers. The settlement includes $150 million in allowed claims, with $18 million paid from bankruptcy funds, and requires enhanced data security measures for the new entity holding the data.
The settlement includes $18 million in monetary relief paid from bankruptcy funds, enhanced data security requirements, appropriate risk analysis, addition of an Advisory Board, agreement to be bound by comprehensive privacy laws without exception, and continuing to offer consumer deletion rights. A separate $46.75 million class-action settlement provides relief to affected U.S. consumers.
In-house legal teams should review vendor agreements with genetic testing companies and data processors to ensure they include robust data security obligations, particularly around credential stuffing prevention, multifactor authentication, and intrusion detection. Customer-facing terms of service and privacy policies should clearly disclose data collection, use, and sharing practices for genetic and biometric data. Employee agreements involving health or genetic data should include consent and deletion rights provisions. Breach notification clauses must specify prompt reporting timelines and cooperation obligations. Data processing agreements should require compliance with comprehensive privacy laws and include audit rights to verify security measures.
Entity
23andMe
Industry
TechnologyOfficial Press Release
https://portal.ct.gov/ag/press-releases/2026-press-releases/attorney-general-tong-leads-multistate-settlement-of-bankruptcy-claims-against-23andme
23andme.pdf?rev=0330c0ffa81f404e82461049017996e1&hash=8FD1EF
https://portal.ct.gov/-/media/ag/press_releases/2026/23andme.pdf?rev=0330c0ffa81f404e82461049017996e1&hash=8FD1EFD1F1D70C0B0E4DDD8DDBA975FB
Connecticut Attorney General Enforcement Page
https://portal.ct.gov/AG/Privacy/Privacy-Resources
"23andMe"
"recovery is limited to $18 million"
"data breach that compromised the genetic data of 6.9 million customers"
"6.9 million customers"
"Connecticut Data Privacy Act"
"new genetic privacy law"
$663K
Attorney General Jay Jones joined 42 attorneys general in a multistate settlement with 23andMe's bankruptcy trustee over a 2023 data breach that compromised genetic data of nearly 7 million customers. The settlement includes $150 million in allowed claims, with immediate recovery of $18 million from bankruptcy funds, of which Virginia receives $662,649. The settlement also requires enhanced data security measures and consumer protections for the new entity, 23andMe Research Institute.
$150.0M
Texas Attorney General Ken Paxton secured a $150 million multistate settlement against 23andMe following a 2023 data breach that exposed genetic and personal data of 6.9 million consumers. The settlement resolves bankruptcy claims and requires enhanced data security, risk assessments, and an independent advisory board, with immediate recovery of $18 million from bankruptcy funds.
$18.0M
New York Attorney General Letitia James and a bipartisan coalition of 42 other attorneys general secured an $18 million settlement from genetic testing company 23andMe for failing to protect customers' private genetic data. The October 2023 data breach exposed sensitive genetic information of 6.9 million consumers, including 305,245 in New York, with some data published for sale on the dark web. The settlement includes monetary penalties and new data protection requirements for the company and its successor, 23andMe Research Institute.
$18.0M
A coalition of 42 state attorneys general settled bankruptcy claims against 23andMe following a 2023 data breach that compromised genetic data of 6.9 million customers. The settlement includes $150 million in allowed claims, with $18 million paid from bankruptcy funds, and requires enhanced data security measures for the successor entity, 23andMe Research Institute.
Connecticut Attorney General William Tong submitted testimony in support of genetic privacy legislation that would grant residents exclusive control over their DNA and genetic data. The legislation is inspired by his office's investigation into 23andMe's data breach affecting over six million customers and the company's subsequent bankruptcy. The bill requires express consent for DNA use, imposes security measures, and prohibits marketing use of DNA.
Texas Attorney General Ken Paxton filed a lawsuit in the 23andMe bankruptcy case to prevent the sale of Texans' genetic data without proper consent. The action seeks to confirm Texans' property rights over their genetic information under the Texas Data Privacy and Security Act and the Texas Direct-to-Consumer Genetic Testing Act. The AG argues that 23andMe's proposed asset sale would violate Texas law requiring separate express consent for disclosure of genetic information.