NY Attorney General James Secures $18 Million From 23andMe for Failing to Protect Customers’ Genetic Data

New York Attorney General Letitia James and a bipartisan coalition secured an $18M settlement with 23andMe over an October 2023 breach that exposed genetic and account data for about 6.9 million customers—including records sold on the dark web—finding that 23andMe lacked basic safeguards (MFA, breached-password blocklists, rate limiting, monitoring). The settlement and subsequent bankruptcy-related actions impose new data security requirements, oversight measures, and consumer deletion rights as customer data was transferred to TTAM (now 23andMe Research Institute).