New York Attorney General Letitia James and a bipartisan coalition of 42 other attorneys general have secured an $18 million settlement with genetic testing company 23andMe over a 2023 data breach that exposed the personal and genetic information of 6.9 million consumers, including 305,245 New Yorkers. New York will receive more than $705,000.
The multistate investigation found 23andMe failed to implement basic security measures to protect customer data. Exposed information included genetic ancestry data, and some customer records were later offered for sale on the dark web.
“Companies have a duty to protect their customers’ personal information from hackers, but 23andMe put millions of its customers at risk with its flimsy security measures,” James said in a statement. “New Yorkers trusted 23andMe with their sensitive and personal genetic data, only to find that data stolen and put up for sale on the dark corners of the internet. As a result of our coalition’s action, 23andMe will pay for violating the law, and strict rules will be put in place to protect their customers.”
Investigators said 23andMe failed to use safeguards such as multifactor authentication, adequate monitoring for suspicious login activity, intrusion prevention, and timely detection of the breach.
As part of the settlement, 23andMe and its successor, the 23andMe Research Institute, must strengthen data security, conduct ongoing risk assessments, maintain an advisory board on data security, and continue allowing customers to delete their genetic information.
The settlement follows 23andMe’s March 2025 bankruptcy filing and the sale of its customer data to TTAM Research, a nonprofit created by the company’s founder and former CEO, Anne Wojcicki, which has since been renamed the 23andMe Research Institute.
The attorneys general of Alabama, Alaska, Arizona, Arkansas, Colorado, Connecticut, Delaware, Florida, Georgia, Idaho, Illinois, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, North Carolina, North Dakota, New Hampshire, New Jersey, New Mexico, Ohio, Oklahoma, Oregon, Pennsylvania, South Carolina, South Dakota, Tennessee, Texas, Utah, Virginia, Vermont, and Washington joined Attorney General James to secure this settlement.
