Utah, 40 other states reach $18M settlement with 23andMe after data breach, bankruptcy
Jul 23, 2026, 6:30 PM
FILE: A sign is posted in front of the 23andMe headquarters on February 01, 2024 in Sunnyvale, California. (Justin Sullivan/Getty Images)
(Justin Sullivan/Getty Images)
SALT LAKE CITY — Utah and over 40 other states on Wednesday announced a $18 million settlement agreement with genetic information company 23andMe after the company filed for bankruptcy in March 2025.
The bankruptcy filing came after the company struggled with the fallout of a data breach and weak demand for its ancestry testing kits.
The five-month data breach in 2023 exposed the personal data of nearly 7 million 23andMe customers. The compromised information included sensitive details regarding users’ identities, ancestry, and genetic profiles.
The saga dealt a blow to 23andMe’s reputation, and the company laid off 200 employees and stopped development of all therapies late last year.
Through the settlement, Utah will receive a $461,688 chunk of the $18 million.
Additionally, Utahns affected by the breach will be compensated separately through a $46.75 million class-action settlement in the bankruptcy case, which provides relief to U.S. consumers who submitted claims by Feb. 17, 2026.
“This settlement sends a clear message: companies that collect sensitive genetic and personal data must uphold the highest standards of privacy and security,” Utah Attorney General Derek Brown said in a statement. “We will continue to hold organizations accountable and protect our residents from the misuse of their most personal information.”
According to a release from the Utah Attorney General’s office, “malicious actors” posted lists of user data for sale, reportedly targeting users of Ashkenazi Jewish and Chinese descent. This ended up prompting a bipartisan investigation into whether 23andMe violated state data privacy, consumer protection, and genetic information privacy laws.
“Holding 23andMe accountable is critical to ensure that companies know they have a responsibility to the consumer, to protect the personal information they receive when people use their services,” Margaret Busse, commissioner of the Utah Department of Commerce, said in a statement. “23andMe failed its customers — it did not do enough to protect them and their most sensitive, private information. This breach of trust is unacceptable.”
The funds from the settlement will be used to “further protect consumers and address the ramifications of the data breach,” according to the release.
