23andMe Faces Multistate Breach Settlement

State attorneys general are resolving claims against 23andMe over a 2023 credential-stuffing attack that exposed genetic ancestry and other personal information from approximately 6.

9 million customers worldwide. The settlements follow 23andMe’s bankruptcy and include state payments, consumer claims, stronger security requirements, and continued rights to delete genetic data. The case highlights the legal and privacy consequences of protecting sensitive genetic information after a breach and during a company asset transfer.