Penalty Amount
$18,000,000
Consumers Affected
6,900,000
Attorney General Jennifer Davenport joined a bipartisan coalition of 42 attorneys general in announcing a settlement with the bankruptcy trustee for 23andMe, resolving allegations from a 2023 data breach that compromised genetic data of 6.9 million people worldwide, including nearly 150,000 in New Jersey. The settlement provides $18 million to states from available bankruptcy funds, plus enhanced data security and consumer deletion rights for the successor entity, 23andMe Research Institute.
The settlement requires 23andMe's successor, 23andMe Research Institute, to implement enhanced data security measures, conduct appropriate risk analysis, add an advisory board, be bound by comprehensive privacy laws, and continue offering consumer deletion rights. States receive $18 million from the bankruptcy estate.
In-house legal teams should review vendor agreements with data processors handling sensitive personal data (e.g., genetic information) to ensure clauses on data security obligations include specific safeguards against credential stuffing attacks, such as multifactor authentication and rate limiting. Customer agreements should include clear consent mechanisms and data deletion rights, and breach notification clauses must require prompt disclosure to affected individuals and regulators. The enforcement highlights the need for routine security audits and adherence to comprehensive privacy laws.
Entity
23andMe, Inc.
Industry
TechnologyOfficial Press Release
https://www.njoag.gov/attorney-general-jennifer-davenport-announces-multistate-settlement-of-bankruptcy-claims-against-23andme-over-genetic-data-breach/
2026 0714 23andMe Motion for Entry
http://www.njoag.gov/wp-content/uploads/2026/07/2026-0714_23andMe-Motion-for-Entry.pdf
New Jersey Attorney General Enforcement Page
https://www.njoag.gov/about/divisions-and-offices/division-of-consumer-affairs/
"23andMe"
"The settlement includes $150 million in allowed claims for states. Due to the finite amount of funds in the bankruptcy estate and numerous other claims, recovery is limited to $18 million"
"23andMe engaged in unreasonable data security practices, including, but not limited to: Failing to employ safeguards against credential stuffing attacks"
"failed to tell consumers when a data breach occurred"
"comprehensive privacy laws without exception"
"6.9 million people worldwide"
$18.0M
A coalition of 42 state attorneys general settled with the bankruptcy trustee for 23andMe over a 2023 data breach that exposed genetic data of 6.9 million customers. The states will receive $18 million from bankruptcy funds, and 23andMe agreed to enhanced data security requirements and consumer deletion rights as part of the asset sale to TTAM Research Institute.
$18.0M
A coalition of 42 state attorneys general reached a settlement with the bankruptcy trustee for 23andMe over a 2023 data breach that compromised the genetic data of 6.9 million customers. The settlement provides $18 million from bankruptcy funds, with Minnesota receiving $514,871, and imposes data security requirements on the successor entity, 23andMe Research Institute.
New York Attorney General Letitia James, joined by 27 other state attorneys general and the District of Columbia, filed a lawsuit against 23andMe to block the company’s planned sale of 15 million customers’ genetic and health data without their consent or knowledge. The coalition argues 23andMe must comply with state laws requiring express informed consent for the sale or transfer of sensitive genetic data. The lawsuit seeks to prevent misuse, exposure in future breaches, and unauthorized use of customers’ private genetic information.
Federal Trade Commission Chairman Andrew N. Ferguson issued a letter to the U.S. Trustee overseeing the 23andMe bankruptcy proceeding, expressing concerns about the potential sale or transfer of consumers' personal genetic data. The letter underscores the importance of companies honoring their privacy promises to consumers, particularly regarding sensitive information, during bankruptcy proceedings.
$45.0M
Block, Inc. agreed to a $45 million multistate settlement with 46 states for allegedly misleading consumers about the safety of Cash App, failing to protect users from fraud, and not providing promised fraud protection. The settlement requires Block to improve customer support, stop misleading claims, and educate consumers about fraud.
Attorney General Jennifer Davenport co-led a coalition of 49 attorneys general in calling on the FCC to strengthen rules to cut off scammers' access to legitimate telephone numbers. The coalition's letter requests stronger certification rules, regular reporting, and prohibitions on number cycling to combat illegal robocalls.