Attorneys general in Connecticut and New York say they’ve reached a $150 million settlement with 23andMe, a direct-to-consumer genetic testing company.
A data breach in 2023 compromised the genetic data of millions of 23andMe customers worldwide. Connecticut and New York joined a multistate coalition that investigated and found that the company engaged in “unreasonable data security practices.”
The breach exposed information about 23andMe customers, including genetic ancestry. The investigation found that, in some cases, data such as genetic information was sold on the dark web. An estimated 305,245 New Yorkers and 65,766 Connecticut residents had their data compromised in the breach.
Attorney General William Tong said in a statement this week that due to the finite amount of funds in the bankruptcy estate, the recovery of available funds is limited to $18 million, which will be paid out immediately. Tong said that out of those disbursements, Connecticut will receive $887,729.
“23andMe collected the most sensitive genetic data imaginable from millions of Americans, and they failed to safeguard that data. Connecticut led the country in investigating this serious breach, and we were actively involved at every step of this bankruptcy proceeding, fighting for accountability and the security of consumers’ personal data and genetic samples,” Tong said.
New York Attorney General Letitia James said 23andMe will pay more than $705,000 to New York customers impacted by the breach. James said it was 23andMe’s lack of security measures that put millions of customers at risk.
“New Yorkers trusted 23andMe with their sensitive and personal genetic data, only to find that data stolen and put up for sale on the dark corners of the internet. As a result of our coalition’s action, 23andMe will pay for violating the law and strict rules will be put in place to protect their customers,” James said.
The company filed for bankruptcy protection in March 2025, and states filed several claims. As part of the bankruptcy proceedings, it sold assets like consumer data to TTAM Research Institute, a non-profit formed by 23andMe founder and former CEO Anne Wojcicki. The terms of the sale include data security requirements.
In the 2026 legislative session, the Connecticut General Assembly passed a new genetic privacy law. The law gives Connecticut residents rights to exercise control over genetic samples and companies must outline disclosure and consent obligations. It established safeguard protections for residents’ genetic data, protected as “sensitive data” under the Connecticut Data Privacy Act. The law goes into effect on October 1, 2026.
