23andMe settles for $150 million in data breach, Michigan gets $436k

A massive settlement has been reached between 42 states and 23AndMe. 

Due to the finite amount of funds in the bankruptcy estate and numerous other claims, recovery is limited to $18 million but will be paid out of available bankruptcy funds immediately. Of the $18 million, Michigan will receive $436,605. 23andMe also agreed to a $46.75 million class-action settlement in the bankruptcy to provide relief to affected U.S. consumers who submitted claims in a process that closed this past February. 

In October 2023, direct-to-consumer genetic testing company 23andMe announced that it had discovered a data breach in which 6.9 million consumers were affected, including 162,865 Michigan residents. This data breach exposed a wide range of data about 23andMe customers, including in some cases genetic ancestry information, and subsets of this data were subsequently published for sale on the dark web. 

According to the attorney generals press release, 23andMe learned about the breach months after impacted personal information was publicly available. 23andMe first denied a breach and then, once it confirmed the breach, blamed consumers for how their accounts were set up or how passwords were used.  

After the breach, the attorneys general formed a multistate investigation and found that 23andMe engaged in unreasonable data security practices, including, but not limited to: 

In March 2025, 23andMe filed for bankruptcy protection, and states subsequently filed claims related to the data breach investigation.  As part of the bankruptcy proceedings, the assets – notably 23andMe’s consumer data – were sold to TTAM Research Institute, a non-profit formed by 23andMe founder and former CEO Anne Wojcicki.  

The terms of the sale included many information and data security requirements that likely would have been included in a settlement with 23andMe had it not filed for bankruptcy. Such terms included enhanced data security requirements, appropriate risk analysis, the addition of an Advisory Board, agreeing to be bound by applicable state comprehensive privacy laws, and continuing to offer consumer deletion rights.  

These terms will make sure that TTAM Research Institute, now re-registered as 23andMe Research Institute, will be a safer custodian of genetic data moving forward.