CRIME & LAW

Minnesota leads $18 million settlement over 23andMe breach

▪

Read, Watch or Listen

Minnesota Attorney General Keith Ellison on Wednesday, July 15, 2026, announced an $18 million multistate settlement with the bankruptcy trustee of 23andMe, now operating as Chrome Holding Co., over a 2023 genetic data breach. Forty-two state attorneys general joined the agreement, which resolves allegations that the company violated consumer protection and privacy laws by failing to protect sensitive genetic and personal data for about 6.9 million customers. Regulators said 23andMe ignored industry-standard security practices, delayed public notification, and initially blamed users’ weak passwords. The settlement, approved in U.S. Bankruptcy Court, marks a key step in winding down the bankrupt firm.

Prepared by Emily Rhodes and reviewed by editorial team.

Timeline of Events

October 2023 Hackers access 23andMe customer accounts
Late 2023 Stolen genetic profiles marketed online
Late 2023 States begin joint investigative actions
March 2025 23andMe files Chapter 11 bankruptcy
March 2025 Bankruptcy stay pauses pending lawsuits
July 15, 2026 States announce $18 million settlement
July 2026 Bankruptcy court reviews settlement terms

Why This Matters to You

Your genetic data is a goldmine for identity thieves. This breach exposed 6.9 million customers' sensitive information. It's a reminder to be vigilant about where you share your DNA data. Regularly check the privacy policies of any genetic testing companies you use.

The Bottom Line

23andMe's bankruptcy and the $18 million settlement highlight the importance of companies safeguarding your personal data. It's a costly reminder that privacy laws matter. Worth forwarding if you know someone who's used a DNA testing service.