Genetic testing company 23andMe (now Chrome Holding Co.) has consented to pay $18 million to resolve allegations from a coalition of 43 attorneys general that it failed to safeguard customers' genetic data.

23andMe revealed a large-scale data breach in October 2023 after credential-stuffing attacks that remained undetected for five months, spanning April 2023 to September 2023.

During the event, attackers obtained information from 6.9 million customers, including genetic ancestry details. Portions of the stolen data later appeared for sale on the dark web, with the perpetrators releasing millions of genetic profiles to verify authenticity.

New York Attorney General Letitia James stated on Tuesday that a multistate probe initiated after the disclosure revealed the company lacked fundamental protections against credential-based cyberattacks, such as password blocklisting or multifactor authentication, along with sufficient rate limiting, intrusion prevention, and breach-detection monitoring.

Investigators further found that 23andMe did not respond to suspicious login patterns or remediate known vulnerabilities. The firm initially rejected claims of a breach and later attributed the incident to customers' account and password habits, according to Attorney General James.

The settlement imposes new security obligations at TTAM, including formation of a data security advisory board, risk analysis procedures, and ongoing consumer rights to delete their data.

"Companies have a duty to protect their customers' personal information from hackers, but 23andMe put millions of its customers at risk with its flimsy security measures," James noted.

"New Yorkers trusted 23andMe with their sensitive and personal genetic data, only to find that data stolen and put up for sale on the dark corners of the internet. As a result of our coalition's action, 23andMe will pay for violating the law and strict rules will be put in place to protect their customers."

Class-action lawsuits, fines, and settlements

The 2023 data breach has also triggered multiple class-action lawsuits, leading 23andMe to update its Terms of Use in November 2023 to limit litigation options, with the company stating at the time that the revisions aimed only to streamline the arbitration process.

In September 2024, the California-based genetic testing provider further agreed to pay $30 million to settle one proposed class action lawsuit tied to the 2023 data breach.

23andMe filed for Chapter 11 bankruptcy in March 2025, outlining plans to sell its assets after years of financial difficulties, which prompted James and the coalition to submit related claims.

In June 2025, James and 27 other attorneys general filed suit to safeguard customers' genetic data amid the bankruptcy proceedings. That same month, the UK Information Commissioner's Office (ICO) levied a fine of £2.31 million ($3.12 million) against 23andMe for serious security shortcomings that caused the profoundly damaging data breach in 2023.

Four months later, in July 2025, the TTAM Research Institute nonprofit (now reregistered as 23andMe Research Institute and led by 23andMe co-founder Anne Wojcicki) finalized the acquisition of the DNA testing company after agreeing to pay $305 million for all its assets.