Texas Attorney General Ken Paxton announced that the state has joined a $150 million multistate settlement with genetic testing company 23andMe over a 2023 data breach that exposed the personal and genetic information of approximately 6.9 million customers worldwide.
The settlement, reached as part of 23andMe’s bankruptcy proceedings, resolves claims brought by a coalition of 42 states after an investigation into the company’s cybersecurity practices.
According to the Texas Attorney General’s Office, the breach exposed a wide range of customer information, including genetic ancestry data for some users. Portions of the stolen information were later offered for sale on the dark web.
The company disclosed the breach in October 2023 after learning that customer data had been compromised months earlier. State investigators said 23andMe initially denied that a breach had occurred and later attributed the incident to customers’ password practices and account configurations.
The multistate investigation concluded that 23andMe failed to implement reasonable data security measures and did not maintain adequate safeguards to protect sensitive consumer information from hackers.
“The 23andMe data breach was a serious failure to protect consumers’ privacy that exposed the genetic information of millions of people,” Paxton said in a statement. “Companies that collect and profit from Texans’ most personal information have a legal duty to protect it. This settlement sends a clear message that companies cannot cut corners on data security. It helps ensure stronger protections for consumers’ genetic information moving forward.”
As part of the agreement, 23andMe must implement enhanced cybersecurity measures, conduct comprehensive risk assessments, and establish an independent advisory board to oversee privacy and security practices.
The settlement also requires the company to comply with applicable state privacy laws and preserve consumers’ rights to delete their personal data. Those requirements will apply to the company’s successor, the 23andMe Research Institute, formerly known as the TTAM Research Institute.
Although the settlement is valued at $150 million, the Attorney General’s Office said only $18 million is immediately available because of the limited assets remaining in 23andMe’s bankruptcy estate and competing creditor claims.
Texas is expected to receive approximately $1.27 million from the available bankruptcy funds.
Separately, 23andMe has agreed to a $46.75 million class-action settlement to compensate eligible U.S. consumers affected by the breach. The settlement covers customers who submitted claims by February 17, 2026.
