Attor­ney Gen­er­al Pax­ton Secures $150 Mil­lion Set­tle­ment Against 23andMe Over Data Breach That Exposed Genet­ic Infor­ma­tion of 6.9 Mil­lion People

Attorney General Ken Paxton secured a settlement of bankruptcy claims against 23andMe, which helps resolve issues stemming from a 2023 data breach that compromised the genetic data of 6.9 million customers worldwide. The settlement includes $150 million for a multistate coalition of 42 states.

In October 2023, direct-to-consumer genetic testing company 23andMe announced that it had discovered a data breach affecting 6.9 million consumers. The breach exposed a wide range of customer data, including, in some cases, genetic ancestry information. Subsets of this data were later published for sale on the dark web. 23andMe learned about the breach months after the impacted personal information had become publicly available. The company initially denied that a breach had occurred and, after confirming it, blamed consumers for how their accounts were configured and how passwords were used.

In the immediate aftermath of the data breach, Attorney General Paxton joined a multistate investigation. The investigation found that 23andMe engaged in unreasonable data security practices and failed to implement adequate safeguards against hacking.

In March 2025, 23andMe filed for bankruptcy protection. As part of the bankruptcy proceedings, the participating states asserted claims arising from the data breach investigation. The resulting settlement incorporates many of the privacy and cybersecurity protections that likely would have been required through a traditional enforcement action. These include enhanced data security standards, comprehensive risk assessments, and the creation of an independent advisory board. Additionally, compliance with applicable state privacy laws will be enforced without exception, and the continued availability of consumer data deletion rights will be preserved. These requirements will help ensure that the TTAM Research Institute, now operating as the 23andMe Research Institute, serves as a more responsible steward of consumers' genetic information moving forward.

"The 23andMe data breach was a serious failure to protect consumers' privacy that exposed the genetic information of millions of people," said Attorney General Paxton. "Companies that collect and profit from Texans' most personal information have a legal duty to protect it. This settlement sends a clear message that companies cannot cut corners on data security. It helps ensure stronger protections for consumers' genetic information moving forward."

Due to the finite amount of funds available in the bankruptcy estate and numerous other claims, recovery is limited to $18 million, which will be paid immediately from the available bankruptcy funds. Of the $18 million, Texas will receive $1,266,860. 23andMe also agreed to a $46.75 million class-action settlement in the bankruptcy to provide relief to affected U.S. consumers who submitted claims by February 17, 2026.

To read the settlement, click here.