Published
July 21, 2026
A bipartisan coalition of 42 state attorneys general has reached an $18 million settlement with 23andMe's bankruptcy estate over the 2023 data breach. The money goes to the states, not consumers — it is a separate track from the $46.75 million consumer class action that closed to claims in February 2026.
What Happened?
On July 14, 2026, a bipartisan coalition of 42 state attorneys general — led by states including Connecticut, New York, Pennsylvania, Illinois, and Colorado — announced an $18 million settlement resolving government enforcement claims against 23andMe over the 2023 data breach. Because the company entered Chapter 11 bankruptcy in March 2025 and its assets have since been sold, the settlement is with the bankruptcy estate of the entity now legally named Chrome Holding Co.The settlement money is paid to the participating states to cover the costs of their investigation and enforcement — it goes to state treasuries, not to individual consumers. It is a distinct matter from the separate $46.75 million consumer class action settlement that resolved private claims over the same breach.
Settlement Amount
$18 million
Announced July 14, 2026 · paid to 42 state treasuries
Who Is Paid
The states — not consumers
Covers state investigation & enforcement costs
Consumer Settlement
Separate · $46.75M (claims closed)
Consumer claim deadline was February 17, 2026 · administered by Kroll
Why the States Took Action
The attorneys general's investigation focused on 23andMe's security practices leading up to the breach. According to the states, a credential-stuffing campaign — in which attackers use username-and-password pairs stolen from other services to break into accounts — ran undetected for roughly five months, from about April to September 2023, before the company noticed it.The coalition alleged that 23andMe had not implemented basic defenses that could have blunted the attack, including:
• No mandatory multi-factor authentication for consumer accounts.
• No screening of passwords against lists of known breached credentials.
• Weak rate limiting and intrusion monitoring, which the states say let the login attempts continue for months.
The states also noted that 23andMe initially attributed the incident to customers reusing old passwords before acknowledging the gaps in its own defenses. 23andMe resolved the states' claims without admitting wrongdoing.
Why the Payout Was Capped at $18 Million
During the Chapter 11 case, the states filed roughly $150 million in claims against 23andMe over the breach. But the bankruptcy estate held limited assets, so the amount actually recoverable was far smaller. The settlement caps the states' recovery at $18 million, paid immediately out of available bankruptcy funds rather than promised over time.In other words, the headline figure the states could pursue on paper ($150 million) and the cash they can actually collect from a bankrupt estate ($18 million) are two different numbers — a common outcome when enforcement claims land inside a bankruptcy.
State-by-State Allocations
Each state's share reflects the size of the claim it filed. Reported allocations include:• Texas: about $1.2 million
• Connecticut: $887,729
• New York: about $705,000
• Pennsylvania: $491,902
• Colorado: $394,324
• Kentucky: $259,375
Other participating states and jurisdictions receive smaller shares on the same claim-size basis.
New Data-Security Mandates on the Buyer
The 2025 sale of 23andMe's consumer data assets went to TTAM Research Institute, a nonprofit led by co-founder Anne Wojcicki that has since re-registered as the 23andMe Research Institute. As part of the states' resolution, the new owner is bound by ongoing data-protection obligations, including:• Maintaining an independent data-security advisory board.
• Undergoing annual third-party risk assessments.
• Continuing to honor customers' rights to permanently delete their genetic records and to request destruction of stored DNA samples.
This Is Not the Consumer Class Action
It is easy to confuse the two 23andMe settlements, so the distinction is worth stating plainly. This $18 million agreement is a state enforcement settlement: the money goes to state governments, and consumers do not file a claim for it.The separate $46.75 million consumer class action settlement is the one that pays affected customers who filed a claim by the February 17, 2026 deadline; it is administered by Kroll and was resolved inside the same bankruptcy. The state money does not come out of, add to, or reduce that consumer fund. For background on how the company reached this point, see our 23andMe bankruptcy explainer.
What This Means If You Want to Delete Your Data
For customers, the most practical effect of the settlement is that the right to delete your data survives the bankruptcy and the change in ownership. The new owner is required to keep honoring requests to delete your account and genetic information and to destroy any stored saliva sample.You can make those requests through your 23andMe account settings. Because Social Security numbers and other sensitive information were exposed in the 2023 breach, it also remains sensible to monitor your credit and watch for suspicious activity.
Frequently Asked Questions
Who gets the $18 million from the 23andMe state settlement?
The $18 million is paid to the 42 participating states to cover their investigation and enforcement costs — it goes to state treasuries, not to individual consumers. It is entirely separate from the $46.75 million consumer class action settlement.
Does the $18 million state settlement affect the consumer class action payout?
No. The $18 million state settlement and the $46.75 million consumer class action settlement are separate. The state money does not come out of, add to, or reduce the consumer settlement fund, which is administered by Kroll for customers who filed a claim by the February 17, 2026 deadline.
Why was the state settlement capped at $18 million?
The states filed roughly $150 million in claims during 23andMe's Chapter 11 bankruptcy, but the bankruptcy estate held limited assets. As a result, the states' recovery was capped at $18 million, paid immediately from available bankruptcy funds.
Can I still delete my 23andMe data and DNA sample?
Yes. Under the settlement's data-security terms, the new owner must continue to honor customers' rights to permanently delete their account and genetic records and to request destruction of stored DNA samples. You can make these requests through your 23andMe account settings.
Sources
- New York Office of the Attorney General, press release on the $18M multistate settlement (July 2026): ag.ny.gov
- Pennsylvania Office of Attorney General, press release on the $18M multistate settlement (July 2026): attorneygeneral.gov
- In re Chrome Holding Co., et al. (f/k/a 23andMe Holding Co. and 23andMe, Inc.), Case No. 25-40976, U.S. Bankruptcy Court for the Eastern District of Missouri
- Official Settlement Website (consumer class action): 23andMeDataSettlement.com
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
For more class actions keep scrolling below.
Status
Settled with 42 states — announced July 14, 2026
Settlement Amount
$18 million (paid to state treasuries)
Bankruptcy Case
In re Chrome Holding Co., et al. (f/k/a 23andMe Holding Co. and 23andMe, Inc.)
Case Number
25-40976
Court
U.S. Bankruptcy Court, Eastern District of Missouri
Acquirer
TTAM Research Institute (re-registered as 23andMe Research Institute)
Official Announcement
N.Y. Attorney General Announcement
