Bay Area-based 23andMe has agreed to cash settlements over a 2023 data breach affecting 6.9 million customers, including $46.75 million for victims and a new $6 million settlement with California.
California Attorney General Rob Bonta has reached a $6.01 million settlement with 23andMe over a 2023 data breach that exposed the personal information of 6.9 million customers, bringing the company’s settlements related to the breach to more than $70 million, as the SF Business Times reports. The total includes a $46.75 million class-action settlement finalized in July and a separate $18 million agreement with attorneys general from 42 states.
The class-action lawsuit also accused 23andMe of failing to warn customers of Chinese and Ashkenazi Jewish ancestry that hackers appeared to have specifically targeted their data, as Reuters reported in September 2024. The company agreed to a preliminary $30 million settlement of that same lawsuit in 2024, which was later revised and finalized at $46.75 million in July 2026.
The breach reportedly began around April 2023 and continued for about five months before 23andMe disclosed it in a company blog post.
As TechCrunch reported at the time, the company first reported that hackers had accessed about 14,000 accounts, but the compromised accounts also gave them access to information about other users through its DNA Relatives feature, which allows customers to find genetic relatives.
The hacker initially posted data allegedly belonging to one million people of Ashkenazi Jewish descent and 100,000 people of Chinese descent, offering to sell the records for $1 to $10 per account.
Two weeks later, the hacker advertised records allegedly belonging to another four million people on the same hacking forum. TechCrunch later found that a separate hacker had advertised a batch of allegedly stolen 23andMe customer data on another forum two months before the widely reported leak.
Ultimately, about 5.5 million people who opted into DNA Relatives had personal information accessed, including names, birth years, ancestry reports, locations, and details about their genetic relationships. Another 1.4 million users had information from their Family Tree profiles accessed.
The breach occurred after hackers used credentials obtained from other data breaches to access 23andMe accounts. According to HIPAA Journal, a multistate investigation later found that the company lacked basic protections against these attacks, including mandatory multifactor authentication and adequate monitoring to detect suspicious login attempts.
The company filed for Chapter 11 bankruptcy protection in March 2025, citing the breach and related litigation, along with increased competition and declining demand for genetic testing. Its financial troubles followed layoffs and a board shake-up as co-founder Anne Wojcicki sought to take the company private.
According to the Business Times, in June 2025, TTAM Research Institute, a nonprofit controlled by Wojcicki, acquired 23andMe’s assets for $305 million. California objected to the sale, arguing that consumers should have been required to consent before their sensitive genetic data was transferred.
The new $6.01 million agreement resolves California’s data breach claims and its objection to the sale. It follows months of litigation over whether the state could pursue monetary penalties despite the company’s bankruptcy proceedings.
“23andMe collected genetic data about millions of people and failed to meet its obligation to keep that information safe,” Bonta said earlier this month. “Companies cannot evade California's consumer protection and privacy laws by filing for bankruptcy.”
In a separate agreement, Chrome Holding Company, the legal entity handling 23andMe’s remaining obligations, agreed to pay $18 million to settle claims brought by attorneys general from 42 states, per the Business Times. That settlement also requires stronger data security measures to protect customers’ information.
Related: Meta Hit With $25 Billion Penalty Over Facebook’s Cambridge Analytica Scandal
