23andMe, Inc., $18,000,000
New York Attorney General Letitia James and a bipartisan coalition of 42 other state attorneys general secured an $18 million settlement from 23andMe over failures tied to its 2023 genetic-data breach and obtained additional data-protection requirements for the successor custodian of the data.
Case identifiers
- Respondent
- 23andMe, Inc. (and TTAM Research (now 23andMe Research Institute))
- Agency
- New York AG and 42 other state attorneys general
- Announced
- 2026-07-14
- Monetary relief
- $18,000,000
- Statutes cited
- State data-security and consumer-protection laws
Key facts
- 1
In October 2023, 23andMe announced a breach affecting 6.9 million consumers, including 305,245 New York consumers, and exposing a broad range of customer data including genetic ancestry information.
- 2
The coalition said some customer data was published for sale on the dark web and found deficiencies including inadequate safeguards against stolen credentials, rate limiting, monitoring, and unusual-login investigation.
- 3
23andMe filed for bankruptcy protection in March 2025; the coalition later secured requirements for TTAM Research, now 23andMe Research Institute, including risk analysis and an advisory board on data security.
- 4
The settlement terms include continuing to offer consumers a right to delete their information.
What the order requires
Injunctive terms imposed by the New York AG and 42 other state attorneys general. These bind 23andMe, Inc.'s data practices going forward.
- Implement appropriate risk analysis and data-security requirements at the successor custodian.
- Create an advisory board focused on data security.
- Continue offering consumers the right to delete their information.
Primary sources
Read the original government documents. These are the authoritative records, everything on this page is derived from them.
- New York AG and 42 other state attorneys general press releasehttps://ag.ny.gov/press-release/2026/attorney-general-james-secures-18-million-23andme-failing-protect-customers
Generate requests in under 60 seconds
Generate a deletion request for $9
FAQ
What did the multi-state charge 23andMe, Inc. with?+
New York Attorney General Letitia James and a bipartisan coalition of 42 other state attorneys general secured an $18 million settlement from 23andMe over failures tied to its 2023 genetic-data breach and obtained additional data-protection requirements for the successor custodian of the data. The New York AG and 42 other state attorneys general cited State data-security and consumer-protection laws.
How much did 23andMe, Inc. pay?+
23andMe, Inc. had monetary relief of $18,000,000, announced on 2026-07-14. The settlement also imposed injunctive terms (see below).
Does the 23andMe, Inc. settlement mean my data has been deleted?+
The order requires 23andMe, Inc. to delete certain categories of consumer data (see injunctive terms). Individual consumers should still exercise state-law deletion rights (CCPA, CPA, TDPSA) to confirm deletion from any remaining successor databases.
How can I read the original multi-state order?+
The New York AG and 42 other state attorneys general press release is available at https://ag.ny.gov/press-release/2026/attorney-general-james-secures-18-million-23andme-failing-protect-customers.