Attorney General Jones Secures Multistate Settlement of Bankruptcy Claims Against 23andMe over Genetic Data Breach

Attorney General Jones Secures Multistate Settlement of Bankruptcy Claims Against 23andMe over Genetic Data Breach 

RICHMOND, Va. – Attorney General Jay Jones today joined a coalition of 42 attorneys general announcing a settlement with the bankruptcy trustee for 23andMe, resolving allegations stemming from a 2023 data breach that compromised the genetic data of nearly 7 million customers worldwide.  

“Virginians and consumers globally have put their trust in companies like 23andMe to handle their DNA data responsibly as they seek to learn more about their family history and ancestry,” said Attorney General Jones. “Thanks to Virginia’s consumer protection laws, we were able to hold 23andMe accountable for their faulty security protocols that put consumers at risk, securing a $662,649 settlement.”  

The settlement includes $150 million in allowed claims for states, but recovery is limited to $18 million to be paid out of available bankruptcy funds immediately. Of the $18 million, Virginia will receive $662,649. 23andMe also agreed to a $46.75 million class-action settlement in the bankruptcy to provide relief to affected U.S. consumers who submitted claims by February 17, 2026. 

In October 2023, direct-to-consumer genetic testing company 23andMe announced that it had discovered a data breach in which 6.9 million consumers were affected, including 170,495 in Virginia. This data breach exposed a wide range of data about 23andMe customers, including in some cases genetic ancestry information, and subsets of this data were subsequently published for sale on the dark web.  

23andMe learned about the breach months after impacted personal information was publicly available. 23andMe first denied a breach and then, once it confirmed the breach, blamed consumers for how their accounts were set up or how passwords were used. 23andMe initially accepted no responsibility for the credential stuffing breach, which is when the attacker collects stolen account credentials and uses them to gain access to user accounts on other systems. This lack of accountability from 23andMe was particularly egregious considering their partnership with MyHeritage, an online genealogy company which was compromised years prior to the breach, resulted in exposing thousands of credentials shared between the websites.  

In the immediate aftermath of the data breach the Attorneys General formed a multistate investigation and found that 23andMe engaged in unreasonable data security practices, including, but not limited to:  

• Failing to appropriately investigate and/or address unusual login patterns, including, for example, a massive spike in login attempts;  

In March 2025, 23andMe filed for bankruptcy protection, and states subsequently filed claims related to the data breach investigation.  As part of the bankruptcy proceedings, the assets – notably 23andMe’s consumer data – were sold to TTAM Research Institute, a non-profit formed by 23andMe founder and former CEO Anne Wojcicki.  The terms of the sale included many information and data security requirements that likely would have been included in a settlement with 23andMe had it not filed for bankruptcy.  Such terms included enhanced data security requirements, appropriate risk analysis, the addition of an Advisory Board, agreeing to be bound by comprehensive privacy laws without exception, and continuing to offer consumer deletion rights. These terms will make sure that TTAM Research Institute, now reregistered as 23andMe Research Institute, will be a safer custodian of genetic data moving forward.    

In addition to general consumer protection and privacy laws, individuals are also protected under Virginia’s Genetic Data Privacy law, which requires direct-to-consumer genetic testing companies to “implement and maintain reasonable security procedures and practices to protect a consumer’s genetic data against unauthorized access, destruction, use, modification, or disclosure.” Virginia Code § 59.1-597(1). The company failed to maintain proper security measures as required by this 2023 law. This settlement is Virginia’s first as it relates to the new Genetic Data Privacy law.  

Attorney General Jay Jones joined the attorneys general of Alaska, Alabama, Arkansas, Arizona, Colorado, Connecticut, Delaware, the District of Columbia, Florida, Georgia, Idaho, Iowa, Illinois, Indiana, Kansas, Kentucky, Louisiana, Massachusetts, Maryland, Maine, Michigan, Minnesota, North Carolina, North Dakota, New Hampshire, New Jersey, New Mexico, New York, Ohio, Oklahoma, Oregon, Pennsylvania, South Carolina, South Dakota, Tennessee, Texas, Utah, Vermont, Washington, Wisconsin, and West Virginia in today’s settlement. 

Published on: July 20, 2026