Attorneys general from Delaware, Maryland and 41 other states have reached a settlement with the bankruptcy trustee overseeing 23andMe, resolving allegations tied to the company's 2023 data breach that exposed the genetic and personal information of 6.9 million customers worldwide.
The settlement includes $150 million in allowed claims for the states. However, because 23andMe filed for bankruptcy in March 2025 and the estate has limited funds with numerous competing claims, the recovery is capped at $18 million, which will be distributed immediately through the bankruptcy proceedings.
Delaware is expected to receive $159,654. In a separate agreement, 23andMe also agreed to a $46.75 million class-action settlement to provide relief to affected U.S. consumers who submitted claims by Feb. 17, 2026.
The settlement follows a multistate investigation launched after 23andMe disclosed in October 2023 that hackers had accessed data belonging to 6.9 million customers, including 16,479 people in Delaware and 94,298 people in Maryland. Exposed information included genetic ancestry data and other personal information, with portions of the stolen data later offered for sale on the dark web.
"Today's results show that my office will continue to hold companies like 23andMe accountable when they fail to safeguard sensitive personal data collected from Delawareans," Delaware Attorney General Kathy Jennings said. "We're going to keep using all of the tools we have, including vigorous enforcement of the Delaware Personal Data Privacy Act, to ensure Delawarean's personal data is well-protected."
Maryland Attorney General Anthony G. Brown said the company failed consumers after they entrusted it with highly sensitive information.
"Marylanders trusted 23andMe to protect their personal data, including highly sensitive genetic data and ancestry information. 23andMe failed to safeguard it and then blamed its customers," Brown said. "Through this settlement, we were able to ensure that Marylanders' genetic information is properly protected going forward. My Office will continue to hold accountable any company that fails to protect Marylanders and their sensitive information."
According to the attorneys general, 23andMe became aware of the breach months after compromised information had become publicly available. The company initially denied a breach before later confirming it and attributing the compromise to customers' password practices. Investigators said the credential stuffing attack exploited passwords previously exposed during an earlier breach involving MyHeritage, a company that partnered with 23andMe.
The multistate investigation concluded that 23andMe used unreasonable data security practices, including failing to protect against credential stuffing attacks, not requiring sufficient multifactor authentication safeguards, failing to implement adequate intrusion prevention and monitoring systems, not investigating unusual login activity, failing to address known security vulnerabilities, and failing to properly review and test security features.
As part of the bankruptcy proceedings, 23andMe's assets, including its consumer genetic database, were sold to TTAM Research Institute, a nonprofit created by 23andMe founder and former CEO Anne Wojcicki. The organization has since been renamed 23andMe Research Institute.
The attorneys general said they secured additional privacy and cybersecurity protections as part of the sale. Those requirements include enhanced data security standards, comprehensive risk assessments, creation of an advisory board, compliance with privacy laws, and continued rights for consumers to request deletion of their data.
Delaware separately objected to the sale before withdrawing its objection after TTAM Research Institute agreed to additional privacy protections and expanded consumer control over genetic information.
