HARRISBURG, PA — Pennsylvania will receive $491,902 under an $18 million multistate bankruptcy settlement resolving allegations that 23andMe failed to protect customer information before a 2023 breach exposed data tied to 6.9 million consumers worldwide.
Attorney General Dave Sunday joined officials from 41 other states and the District of Columbia in the settlement, which resolves claims filed during the genetic testing company’s bankruptcy proceedings. The breach affected 192,093 Pennsylvania consumers, according to the Attorney General’s Office.
23andMe also agreed to a separate $46.75 million class-action settlement for affected U.S. consumers who submitted claims by Feb. 17. Eligible consumers were expected to receive notification by email regarding potential payments.
The company disclosed the breach in October 2023 after attackers gained access to customer accounts through credential stuffing, a method that uses passwords stolen from other services to attempt unauthorized logins.
The exposed information included genetic ancestry data in some cases, and portions of the stolen records were later advertised for sale on the dark web, according to the Attorney General’s Office.
State investigators alleged 23andMe lacked adequate safeguards against credential stuffing, including mandatory multifactor authentication and screening passwords against lists of previously compromised credentials.
The investigation also identified alleged deficiencies in rate limiting, intrusion prevention, system monitoring, responses to unusual login patterns, remediation of known vulnerabilities and testing of product features.
“This company was trusted by millions of Americans to safeguard very private data and information, but failed to do so,” Sunday said. He also criticized 23andMe for initially blaming customers’ password practices rather than accepting responsibility for the breach.
The company filed for bankruptcy protection in March 2025, prompting Pennsylvania and other states to pursue claims through the bankruptcy process.
23andMe’s assets, including its consumer data, were sold to TTAM Research Institute, a nonprofit formed by company founder and former Chief Executive Officer Anne Wojcicki. The organization has since been registered as 23andMe Research Institute.
Terms of the sale require enhanced data-security practices, formal risk assessments, an advisory board, adherence to comprehensive privacy laws and continued access to consumer data-deletion options.
The Attorney General’s Office indicated those requirements are intended to strengthen protections for genetic information under the company’s new ownership.
Support the local news that supports Chester County. MyChesCo delivers reliable, fact-based reporting and essential community resources—free for everyone. If you value that, click here to become a patron today.