Settlement over 23andMe data breach to bring Alabama more than $260,000

GCM Staff Report

Alabama Attorney General Steve Marshall joined a coalition of 42 attorneys general in announcing a settlement with the bankruptcy trustee for 23andMe, resolving claims tied to a 2023 data breach that exposed the genetic and personal information of millions of customers.

The settlement allows $150 million in claims for participating states, a news release said. Because of limited funds available through the bankruptcy estate and competing claims, states will recover $18 million, which will be distributed immediately from available bankruptcy funds. Alabama is set to receive $260,817.

The agreement stems from a data breach disclosed by direct-to-consumer genetic testing company 23andMe in October 2023. The breach affected 6.9 million consumers worldwide, including 69,950 Alabamians. Exposed information included customer data and, in some cases, genetic ancestry information. Portions of the stolen data were later offered for sale on the dark web.

“Last fall, we advised consumers to delete their accounts with 23andMe due to lack of accountability discovered within the tech company. While this settlement is a giant step in the right direction to begin to hold 23andMe accountable, it does not justify their actions,” Marshall said. “Protecting consumer data, especially that of personal genetics should be the highest security priority for these companies and the Attorney General’s Office will continue to ensure that Alabama law is complied with and that no more consumers face this exploitation.”

According to the attorneys general, 23andMe learned of the breach months after affected personal information had already become publicly available. The company initially denied a breach had occurred and later blamed consumers for account settings and password practices after confirming the incident.

Investigators said 23andMe initially accepted no responsibility for the credential stuffing attack. They noted the company’s partnership with MyHeritage, which had previously experienced a security breach that exposed thousands of credentials shared between the two platforms.

A multistate investigation launched shortly after the breach found that 23andMe engaged in what attorneys general described as unreasonable data security practices. Investigators said the company failed to implement protections against credential stuffing attacks, including comparing passwords against lists of known compromised passwords and requiring multifactor authentication. They also found shortcomings in rate limiting, intrusion prevention, logging and monitoring systems, investigations of unusual login activity, remediation of known vulnerabilities and testing of design features.

In March 2025, 23andMe filed for bankruptcy protection. States later filed claims related to the data breach investigation.

As part of the bankruptcy proceedings, 23andMe’s assets, including consumer data, were sold to TTAM Research Institute, a nonprofit created by 23andMe founder and former CEO Anne Wojcicki. The organization has since been reregistered as the 23andMe Research Institute.

Officials said the sale included extensive privacy and security requirements that likely would have been part of a settlement had the company not entered bankruptcy. Those requirements include stronger data security measures, risk analysis procedures, creation of an advisory board, compliance with comprehensive privacy laws without exception and continued consumer data deletion rights.

Attorneys general said those provisions are intended to ensure the newly formed organization serves as a safer custodian of genetic data moving forward.

Separately, 23andMe agreed to a $46.75 million class-action settlement through the bankruptcy process to provide relief to affected U.S. consumers who submitted claims by Feb. 17 of this year.

Marshall joined attorneys general from Alaska, Arkansas, Arizona, Colorado, Connecticut, Delaware, the District of Columbia, Florida, Georgia, Idaho, Iowa, Illinois, Indiana, Kansas, Kentucky, Louisiana, Massachusetts, Maryland, Maine, Michigan, Minnesota, New Hampshire, New Jersey, New Mexico, New York, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, South Carolina, South Dakota, Tennessee, Texas, Utah, Virginia, Vermont, Washington, Wisconsin and West Virginia in the settlement.

The full settlement filing is available at www.alabamaag.gov.