Aggrostats

Attorney General Liz Murrill joined a coalition of 42attorneys general announcing a settlement with the bankruptcy trustee for23andMe, resolving allegations stemming from a 2023 data breach thatcompromised the genetic data of 6.9 million customers worldwide.

23andMe agreed to a $46.75 million class-action settlementin the bankruptcy to provide relief to affected U.S. consumers who submittedclaims by February 17, 2026.

The settlement also includes $150 million in allowed claimsfor states. Due to the finite amount offunds in the bankruptcy estate and numerous other claims, recovery is limitedto $18 million, which will be paid out of available bankruptcy fundsimmediately. Louisiana will receive $258,668.

“Louisianans should never have to worry that their personalinformation and genetic data will be exposed because a company failed toprotect it. Companies that collect and profit from sensitive personalinformation have a responsibility to safeguard that data, and when they fail,they will be held accountable,” said Attorney General Liz Murrill.

In October 2023, direct-to-consumer genetic testing company23andMe announced that it had discovered a data breach in which 6.9 millionconsumers were affected, including 68,814 in Louisiana. This data breachexposed a wide range of data about 23andMe customers, including in some casesgenetic ancestry information, and subsets of this data were subsequentlypublished for sale on the dark web.

23andMe learned about the breach months after impactedpersonal information was publicly available. 23andMe first denied a breach andthen, once it confirmed the breach, blamed consumers for how their accountswere set up or how passwords were used. 23andMe initially accepted noresponsibility for the credential stuffing breach, which was particularlyegregious considering 23andMe’s partnership with MyHeritage, which itself wascompromised years prior to the breach, exposing thousands of credentials sharedbetween the websites.

In the immediate aftermath of the data breach, theAttorneys General formed a multistate investigation and found that 23andMeengaged in unreasonable data security practices, including, but not limited to:

• Failing to employ safeguards against credential stuffing attacks, including comparing passwords against blocklists of known breached passwords or requiring multifactor authentication;
• Failing to implement appropriate rate limiting or intrusion prevention;
• Failing to implement logging and monitoring or other tools likely to detect a data breach;
• Failing to appropriately investigate and/or address unusual login patterns, including, for example, a massive spike in login attempts;
• Failing to remediate known vulnerabilities; and
• Failing to properly review and test design features.

In March 2025, 23andMe filed for bankruptcy protection, andstates subsequently filed claims related to the data breach investigation. Aspart of the bankruptcy proceedings, the assets—notably 23andMe’s consumerdata—were sold to TTAM Research Institute, a non-profit formed by 23andMefounder and former CEO Anne Wojcicki. The terms of the sale included manyinformation and data security requirements that likely would have been includedin a settlement with 23andMe had it not filed for bankruptcy. Such termsincluded enhanced data security requirements, appropriate risk analysis, theaddition of an Advisory Board, agreeing to be bound by comprehensive privacylaws without exception, and continuing to offer consumer deletion rights. Theseterms will make sure that TTAM Research Institute, now reregistered as 23andMeResearch Institute, will be a safer custodian of genetic data moving forward.

Attorney General Murrill joined the attorneys general ofAlaska, Alabama, Arkansas, Arizona, Colorado, Connecticut, Delaware, theDistrict of Columbia, Florida, Georgia, Idaho, Iowa, Illinois, Indiana, Kansas,Kentucky, Massachusetts, Maryland, Maine, Michigan, Minnesota, North Carolina,North Dakota, New Hampshire, New Jersey, New Mexico, New York, Ohio, Oklahoma,Oregon, Pennsylvania, South Carolina, South Dakota, Tennessee, Texas, Utah,Virginia, Vermont, Washington, Wisconsin, and West Virginia in today’ssettlement.