Attorney General Steve Marshall announced on Thursday that a multi-state settlement had been reached with the bankruptcy trustee for 23andMe, the now-defunct genetic testing company, after a data breach that reportedly exposed customers' genetic ancestry information, personal information and other data.
Of the $18 million agreed to in the 42-state settlement, Alabama will receive $260,817. 23andMe also agreed to a $46.75 million class-action settlement in the bankruptcy to provide relief to affected U.S. consumers who submitted claims by February 17, 2026. Marshall's office claimed funds were limited due to the company's bankruptcy proceedings.
"Last fall, we advised consumers to delete their accounts with 23andMe due to a lack of accountability discovered within the tech company," Marshall said. "While this settlement is a giant step in the right direction to begin to hold 23andMe accountable, it does not justify their actions. Protecting consumer data, especially that of personal genetics should be the highest security priority for these companies and the Attorney General's Office will continue to ensure that Alabama law is complied with and that no more consumers face this exploitation."
In October 2023, 23andMe announced a data breach that included 69,950 Alabamians, out of the nearly 7 million affected nationwide. The breach exposed a wide range of data about 23andMe customers, including genetic ancestry and personal data. Some of the data was subsequently published on the dark net.
According to Marshall's office, 23andMe first denied a breach, then later blamed consumers for how their accounts were set up or how they used their passwords.
As part of the bankruptcy proceedings, 23andMe's assets and consumer data were sold to TTAM Research Institute, a non-profit formed by 23andMe founder and former CEO Anne Wojcicki.
The terms of the sale included extensive information and numerous data security requirements, including enhanced data security, appropriate risk analysis, the addition of an Advisory Board, agreeing to be bound by comprehensive privacy laws without exception, and continuing to offer consumer deletion rights. TTAM Research Institute was later re-registered as 23andMe Research Institute.
To connect with the author of this story or to comment, email [email protected].
Don't miss out! Subscribe to our newsletter and get our top stories every weekday morning.
