Penalty Amount
$18,000,000
Consumers Affected
6,900,000
A coalition of 42 state attorneys general reached a settlement with the bankruptcy trustee for 23andMe over a 2023 data breach that compromised the genetic data of 6.9 million customers. The settlement provides $18 million from bankruptcy funds, with Minnesota receiving $514,871, and imposes data security requirements on the successor entity, 23andMe Research Institute.
The settlement provides $18 million from bankruptcy funds to the states, with Minnesota receiving $514,871. The successor entity, 23andMe Research Institute, must implement enhanced data security requirements, conduct appropriate risk analysis, establish an Advisory Board, comply with comprehensive privacy laws, and continue offering consumer deletion rights.
In-house legal teams should review vendor agreements with data processors handling sensitive personal information (especially genetic or health data) to ensure they include robust data security obligations such as multifactor authentication, rate limiting, intrusion detection, and logging/monitoring. Customer-facing privacy policies and terms of service should clearly define data security practices and breach notification timelines. Employee agreements and data handling policies should mandate compliance with these security measures. Additionally, contracts with third-party partners (like MyHeritage) should address shared credential risks and require prompt breach notification.
Entity
23andMe, Inc.
Industry
Technology"23andMe"
"$18 million"
"Minnesota’s Genetic Information Privacy Act"
"data breach that compromised the genetic data of 6.9 million customers"
"6.9 million customers"
"coalition of 42 attorneys general"
$18.0M
Attorney General Jennifer Davenport joined a bipartisan coalition of 42 attorneys general in announcing a settlement with the bankruptcy trustee for 23andMe, resolving allegations from a 2023 data breach that compromised genetic data of 6.9 million people worldwide, including nearly 150,000 in New Jersey. The settlement provides $18 million to states from available bankruptcy funds, plus enhanced data security and consumer deletion rights for the successor entity, 23andMe Research Institute.
$18.0M
A coalition of 42 state attorneys general settled with the bankruptcy trustee for 23andMe over a 2023 data breach that exposed genetic data of 6.9 million customers. The states will receive $18 million from bankruptcy funds, and 23andMe agreed to enhanced data security requirements and consumer deletion rights as part of the asset sale to TTAM Research Institute.
New York Attorney General Letitia James, joined by 27 other state attorneys general and the District of Columbia, filed a lawsuit against 23andMe to block the company’s planned sale of 15 million customers’ genetic and health data without their consent or knowledge. The coalition argues 23andMe must comply with state laws requiring express informed consent for the sale or transfer of sensitive genetic data. The lawsuit seeks to prevent misuse, exposure in future breaches, and unauthorized use of customers’ private genetic information.
Federal Trade Commission Chairman Andrew N. Ferguson issued a letter to the U.S. Trustee overseeing the 23andMe bankruptcy proceeding, expressing concerns about the potential sale or transfer of consumers' personal genetic data. The letter underscores the importance of companies honoring their privacy promises to consumers, particularly regarding sensitive information, during bankruptcy proceedings.
This press release is about a court temporarily blocking the merger of Warner Bros. Discovery and Paramount Skydance Corporation based on antitrust concerns under the Clayton Act. It is not a privacy-related enforcement action. The Minnesota Attorney General joined a multistate coalition to challenge the merger, and the court granted a temporary restraining order.
$29.6M
Minnesota Attorney General Keith Ellison joined a 48-state coalition in a $29.6 million settlement with generic-drug manufacturer Glenmark to resolve allegations of a widespread conspiracy to artificially inflate and manipulate prices, reduce competition, and restrain trade for numerous generic prescription drugs. The settlement requires Glenmark to cooperate in ongoing multistate lawsuits and implement internal reforms to ensure compliance with antitrust laws.