23andMe: $18M Settlement Over 2023 Data Breach has been reached between the genetic testing company and attorneys general from 43 states. The settlement, which totals $18 million, resolves claims stemming from a major security incident in 2023. The breach exposed sensitive genetic information tied to nearly 7 million customers, prompting a multi-state investigation. The 23andMe settlement was announced as part of an agreement to address the data privacy failures that allowed unauthorized access to personal and genetic data for months.
The 23andMe data breach first came to light in October 2023, when the company confirmed that hackers had accessed customer profiles using recycled passwords from other breaches. The attackers specifically targeted users of Ashkenazi Jewish and Chinese heritage, using a credential-stuffing technique. This incident highlighted significant weaknesses in the company’s security protocols and its response to the intrusion. The 23andMe settlement with 43 states includes a requirement for the company to implement stronger security measures and to offer affected users multi-factor authentication.
Under the terms of the 23andMe settlement, the company will pay $18 million to the participating states, with funds used for consumer protection and data privacy enforcement. Additionally, the company must delete any user data that was improperly accessed and provide clear notifications about data retention policies. The agreement also mandates that 23andMe conduct regular security audits and maintain a comprehensive information security program. These changes aim to prevent future breaches and rebuild trust among its customer base.
This 23andMe settlement serves as a reminder of the critical importance of data security in the genetic testing industry. While the company avoided admitting fault, the financial penalty and operational changes signal a serious regulatory response. Customers are advised to update passwords and enable enhanced security features on their accounts. For now, the resolution provides a measure of accountability and a path forward for protecting sensitive genetic information.