Texas Attorney General lands $150M 23andMe set­tle­ment for data breach

“The 23andMe data breach was a serious failure to protect consumers’ privacy that exposed the genetic information of millions of people,” Paxton said. “Companies that collect and profit from Texans’ most personal information have a legal duty to protect it. This settlement sends a clear message that companies cannot cut corners on data security. It helps ensure stronger protections for consumers’ genetic information moving forward.”

In October 2023, direct-to-consumer genetic testing company 23andMe announced that it had discovered a data breach affecting 6.9 million consumers. The breach exposed a wide range of customer data, including, in some cases, genetic ancestry information. Subsets of this data were later published for sale on the dark web.

23andMe learned about the breach months after the impacted personal information had become publicly available. The company initially denied that a breach had occurred and, after confirming it, blamed consumers for how their accounts were configured and how passwords were used.

In the immediate aftermath of the data breach, Paxton joined a multistate investigation. The investigation found that 23andMe engaged in unreasonable data security practices and failed to implement adequate safeguards against hacking.

In March 2025, 23andMe filed for bankruptcy protection. As part of the bankruptcy proceedings, the participating states asserted claims arising from the data breach investigation. The resulting settlement incorporates many of the privacy and cybersecurity protections that likely would have been required through a traditional enforcement action, which include enhanced data security standards, comprehensive risk assessments, and the creation of an independent advisory board.

Additionally, compliance with applicable state privacy laws will be enforced without exception, and the continued availability of consumer data deletion rights will be preserved. The requirements will help ensure that the TTAM Research Institute, now operating as the 23andMe Research Institute, serves as a more responsible steward of consumers' genetic information moving forward.

Due to the finite amount of funds available in the bankruptcy estate and numerous other claims, recovery is limited to $18 million, which will be paid immediately from the available bankruptcy funds. Of the $18 million, Texas will receive $1,266,860.

23andMe also agreed to a $46.75 million class-action settlement in the bankruptcy to provide relief to affected U.S. consumers who submitted claims by February 17.