23andMe to adopt new security rules in $18m data breach settlement
This digest was compiled by AI from multiple sources — links to the originals are below.
A coalition of 42 US attorneys general announced an $18m settlement with genetic testing firm 23andMe over a 2023 data breach that exposed over six million customers' ancestry data. The settlement imposes new data protection requirements on 23andMe and its successor TTAM Research, including mandatory risk analysis and an advisory board. New York Attorney General Letitia James said the company will also pay more than $705,000 to New York.
The Settlement Terms
The $18m settlement resolves investigations by 42 state attorneys general into the 2023 credential stuffing attack that compromised 6.4 million customers' profiles. 23andMe will pay $705,000 to New York and implement new security measures including risk analysis, an advisory board, and consumer data deletion rights. The agreement also covers TTAM Research, the non-profit that acquired 23andMe's customer data during its bankruptcy.
Bankruptcy and Legal Challenges
23andMe filed for Chapter 11 bankruptcy in March 2025. In June, attorneys general from 28 states sued to protect customer genetic data during the sale. A bankruptcy judge approved a separate $46.75m compensation fund for breach victims on July 7. However, on July 10, the judge ruled California cannot seek damages from the company due to its reorganization plan, giving the state 14 days to amend its lawsuit.
Regulatory Fines
In addition to the U.S. settlement, 23andMe was fined €2.4m ($2.6m) by European regulators. The company faces ongoing scrutiny over its data security practices, which Attorney General James described as 'flimsy' in a statement. The breach stemmed from customers' poor password management and lack of multi-factor authentication, not a direct network intrusion.
What's Next
California has 14 days to amend its lawsuit against 23andMe or face dismissal. It remains unclear whether the company's bankruptcy plan will fully satisfy all state and federal data protection demands.
1 source
23andMe to adopt new security rules in $18m data breach settlement
