Attorney General James secures $18M settlement with 23andMe over 2023 data breach
According to the attorney general's office, the October 2023 breach exposed a broad range of customer information, including genetic ancestry data.
More Stories
New York Attorney General Letitia James announced Tuesday that she and a bipartisan coalition of 42 other attorneys general have secured an $18 million settlement with genetic testing company 23andMe over a 2023 data breach that exposed the personal information of nearly seven million customers, including more than 305,000 New Yorkers.
According to the attorney general's office, the October 2023 breach exposed a broad range of customer information, including genetic ancestry data. Officials said some of the stolen information was later listed for sale on the dark web.
The multistate investigation found that 23andMe failed to implement basic cybersecurity protections that could have helped prevent or detect the breach. Investigators alleged the company lacked adequate safeguards against cyberattacks using stolen credentials, failed to monitor unusual login activity, did not promptly detect the breach and failed to properly review and test security features.
"Companies have a duty to protect their customers' personal information from hackers, but 23andMe put millions of its customers at risk with its flimsy security measures," James said in a statement. "New Yorkers trusted 23andMe with their sensitive and personal genetic data, only to find that data stolen and put up for sale on the dark corners of the internet. As a result of our coalition's action, 23andMe will pay for violating the law and strict rules will be put in place to protect their customers."
As part of the settlement, 23andMe must implement stronger data security measures designed to better protect customer information. The company will also pay more than $705,000 to New York.
The settlement follows the company's March 2025 bankruptcy filing. During the bankruptcy proceedings, James and a coalition of attorneys general filed claims related to the data breach investigation. In June 2025, James and attorneys general from 27 other states also sued to protect customers' genetic information during the bankruptcy process.
Following the bankruptcy proceedings, 23andMe's customer data was sold to TTAM Research, a nonprofit organization formed by the company's founder.
News 12 reached out to 23andMe for comment but did not hear back as of Tuesday evening.
