Health Law Daily Wrap Up, CONFIDENTIALITY—SETTLEMENT AGREEMENTS: 23andMe Agrees to Pay 42 States $18M to Settle Data Breach Claims, (Jul 16, 2026)
23andMe’s corporate successor has agreed to pay $18 million to 42 states to resolve claims stemming from a 2023 data breach that exposed the personal data of nearly 7 million 23andMe customers, according to a proposed settlement filed today in bankruptcy court.
The settlement was reached between the attorneys general from the 42 states and the administrators overseeing 23andMe’s bankruptcy proceedings in U.S. Bankruptcy Court for the Eastern District of Missouri. 23andMe emerged from Chapter 11 bankruptcy last year as a new nonprofit entity, TTAM Research Institute, that still operates under the 23andMe name. The remainder of 23andMe’s assets and debts are held by Chrome Holding Co., which is settling claims against 23andMe under the supervision of a plan administration trust.
The trust told the court that the state AGs had sought “billions of dollars in alleged damages, and while the Trust maintains that penalties will be unwarranted here, litigating these claims would be a protracted and costly process.”
The court scheduled an Aug. 10 hearing to consider the settlement (In re: 23andMe Holding Co., et al., No. 25-40976 (Bankr. E.D. Mo. Mar. 23, 2025)).
New York AG Letitia James (D.), who led the 42-state coalition, said the settlement also imposed data security requirements on TTAM Research Institute “to protect customers’ data and prevent future breaches.”
“These measures include appropriate risk analysis, the addition of an Advisory Board on data security, and continuing to offer consumers the right to delete their information. These terms will ensure that TTAM, now reregistered as 23andMe Research Institute, will be a safer custodian of genetic data moving forward,” AG James said in a news release.
Hackers using a “credential stuffing” attack, which exploits the common habit of using the same passwords for different services, exposed personal information, including genetic data, of about 7 million 23andMe customers in the 2023 breach. 23andMe should have protected its customers “against cyber-attacks utilizing stolen credentials including, comparing passwords against blocklists of known breached passwords or requiring multifactor authentication,” AG James said.
“New Yorkers trusted 23andMe with their sensitive and personal genetic data, only to find that data stolen and put up for sale on the dark corners of the internet. As a result of our coalition’s action, 23andMe will pay for violating the law and strict rules will be put in place to protect their customers,” she said.
New York was joined in the proposed settlement by AGs from Alabama, Alaska, Arizona, Arkansas, Colorado, Connecticut, Delaware, Florida, Georgia, Idaho, Illinois, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, New Hampshire, New Jersey, New Mexico, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, South Carolina, South Dakota, Tennessee, Texas, Utah, Vermont, Virginia, Washington, West Virginia, Wisconsin, and the District of Columbia.
California AG Rob Bonta (D.) is pursuing a separate settlement with 23andMe through litigation in California state court. But the bankruptcy court told AG Bonta last week that he couldn’t obtain monetary relief in state court.
CIAsSettlementAgreements: SettlementAgreementsNews ConfidentialityNews EnforcementNews HIPAANews