California Settles 23andMe Data Breach Lawsuit for $6 Million
In July, a coalition of 42 state attorneys general agreed to an $18 million settlement with 23andMe to resolve claims that the company violated state laws by failing to implement appropriate data security measures to prevent credential-based attacks. California did not participate in the action, having opted to pursue its own legal claims against the company. A settlement has now been agreed between 23andMe and California to resolve the alleged violations of California laws.
The data breach, covered by the HIPAA Journal in this post, exposed the personal information and genetic information of approximately 6.9 million individuals, including 855,000 California residents. While the attack involved credential stuffing and took advantage of 23andMe customers’ poor password security practices, the states argued that the company should have been aware that there was a risk of customer accounts being targeted, and the company should therefore have implemented security measures for detecting and blocking attacks on customer accounts.
Following the security incident, 23andMe filed for bankruptcy protection and the company was bought for $305 million by TTAM Research Institute, a non-profit controlled by 23andMe co-founder Anne Wojcicki. California attempted to block the sale of the company, claiming it violated the California Genetic Information Privacy Act because 23andMe customers had not given their consent to the sale, which involved the transfer of their personal and genetic information to TTAM Research Institute. The state’s attempt to block the sale was unsuccessful, and a bankruptcy court judge ruled that California could not sue TTAM Research Institute over the data breach to recover money.
California planned to appeal the ruling; however, under the data breach settlement agreement, the state has agreed to drop further appeals. Under the terms of the settlement, California will be paid $6 million. While the sale of the company and transfer of customer data to TTAM Research Institute will go ahead, 23andMe customers have the right to request that their personal and genetic data be deleted.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
“I am proud to fight for the privacy rights of Californians and to deliver this settlement for consumers who put their trust in 23andMe,” said California Attorney General Rob Bonta. “I want to remind Californians that customers of 23andMe can delete their private, genetic data — no matter who owns it.” In addition to the $24 million in settlements, 23andMe agreed to settle class action data breach litigation and will pay $46.75 million to its customers. The settlement was approved by the court in July 2026.
