Attorney General Ken Paxton has secured a settlement of bankruptcy claims against 23andMe, which helps resolve issues stemming from a 2023 data breach that compromised the genetic data of 6.9 million customers worldwide.
The settlement includes $150 million for a multistate coalition of 42 states.
In October 2023, directto- consumer genetic testing company 23andMe announced that it had discovered a data breach affecting 6.9 million consumers. The breach exposed a wide range of customer data, including, in some cases, genetic ancestry information. Subsets of this data were later published for sale on the dark web.
23andMe learned about the breach months after the impacted personal information had become publicly available. The company initially denied that a breach had occurred and, after confirming it, blamed consumers for how their accounts were configured and how passwords were used.
In the immediate aftermath of the data breach, Paxton joined a multistate investigation. The investigation found that 23andMe engaged in unreasonable data security practices and failed to implement adequate safeguards against hacking.
In March 2025, 23andMe filed for bankruptcy protection. As part of the bankruptcy proceedings, the participating states asserted claims arising from the data breach investigation. The resulting settlement incorporates many of the privacy and cybersecurity protections that likely would have been required through a traditional enforcement action.
“The 23andMe data breach was a serious failure to protect consumers’ privacy that exposed the genetic information of millions of people,” said Paxton. “Companies that collect and profit from Texans’ most personal information have a legal duty to protect it. This settlement sends a clear message that companies cannot cut corners on data security. It helps ensure stronger protections for consumers’ genetic information moving forward.”
Due to the finite amount of funds available in the bankruptcy estate and numerous other claims, recovery is limited to $18 million, which will be paid immediately from the available bankruptcy funds. Of the $18 million, Texas will receive $1,266,860. 23andMe also agreed to a $46.75 million class-action settlement in the bankruptcy to provide relief to affected U.S. consumers who submitted claims by February 17.