Attorney General Jonathan Skrmetti Secures Multistate Settlement over 23andMe Genetic Data Breach

Attorney General Jonathan Skrmetti Secures Multistate Settlement over 23andMe Genetic Data Breach

Tennessee Attorney General Jonathan Skrmetti today joined a coalition of 43 attorneys general in securing a settlement with the bankruptcy trustee for 23andMe, resolving states' claims stemming from the company's 2023 data breach that exposed the sensitive genetic and personal information of 6.9 million customers worldwide. States will recover $18 million in available funds, with Tennessee expecting to receive $348,687.

"When the privacy of our genetic information is compromised, we can never get that back. The security of our genome matters not just for us, but for our families," said Attorney General Skrmetti. "This settlement holds 23andMe accountable for its serious security failures and seeks to ensure stronger protections for our sensitive data going forward. This case is a wakeup call for consumers, legislators, and enforcers across the country."

The breach affected millions of consumers, including 116,395 Tennesseans, exposing sensitive information such as genetic ancestry data and other personal information. The multistate investigation found that 23andMe failed to implement reasonable safeguards to protect consumer data, including protections against credential stuffing attacks, adequate monitoring for suspicious activity, and timely responses to known security vulnerabilities. The company also delayed acknowledging the breach and initially blamed consumers rather than accepting responsibility for its inadequate security practices.

After 23andMe filed for bankruptcy in 2025, its assets-including consumer genetic data-were sold to TTAM Research Institute. As part of the bankruptcy proceedings, the purchaser agreed to enhanced data security and privacy protections, including stronger security requirements, ongoing risk assessments, independent oversight, compliance with applicable privacy laws, and continued consumer rights to delete their genetic information.

Attorney General Skrmetti joined the attorneys general of Alaska, Alabama, Arkansas, Arizona, Colorado, Connecticut, Delaware, the District of Columbia, Florida, Georgia, Idaho, Iowa, Illinois, Indiana, Kansas, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, New Hampshire, New Jersey, New Mexico, New York, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, South Carolina, South Dakota, Texas, Utah, Vermont, Virginia, Washington, West Virginia, Wisconsin, and Wyoming in securing today's settlement.

Read the settlement.