Utah announces $18 million multistate settlement in 23andMe bankruptcy  

Resolution Addresses Genetic Data Breach Impacting Millions 

SALT LAKE CITY, Utah – The Office of the Utah Attorney General and the Utah Department of Commerce’s Division of Consumer Protection, alongside a coalition of more than forty states, today announced an $18 million settlement arising from the bankruptcy proceedings of genetic information company 23andMe.  

23andMe, once a leader in consumer genetic analysis and ancestry testing, allowed users to submit DNA samples for analysis of their genetic profile. In 2023, the company suffered a significant data breach affecting approximately 6.9 million users. The compromised information included sensitive details regarding users’ identities, ancestry, and genetic profiles.   

After the breach, hackers posted lists for sale on the dark web, reportedly targeting users of Ashkenazi Jewish and Chinese descent. This exposure of ethnically-targeted lists prompted a bipartisan investigation into whether 23andMe violated state data privacy, consumer protection, and genetic information privacy laws. 

Utah will receive $461,688 as its share of the $18 million settlement. Utahns affected by the breach will be compensated separately through a $46.75 million class-action settlement in the bankruptcy; the deadline to submit a claim was February 17, 2026. 

“This settlement sends a clear message: companies that collect sensitive personal data, including genetic data, must uphold the highest standards of privacy and security,” said Utah Attorney General Derek Brown. “We will continue to hold organizations accountable and protect our residents from the misuse of their most private personal information.” 

In early 2025, 23andMe declared bankruptcy. During the proceedings, coalition states successfully secured restrictions on the future use of genetic information previously collected by the company, ensuring enhanced protections going forward. 

“Holding 23andMe accountable is critical to ensure that companies know they have a responsibility to the consumer, to protect the personal information they receive when people use their services,” said Margaret Busse, Commissioner of the Utah Department of Commerce. “23andMe failed its customers—it did not do enough to protect them, and their most sensitive, private information. This breach of trust is unacceptable.” 

For more information about the settlement and available resources for affected individuals, please contact the Office of the Utah Attorney General at (801) 366-0260 or email [email protected].