23andMe Pays $18 Million to Settle Multistate Data Breach Lawsuit
23andMe, now operating as Chrome Holding Co., has reached an $18 million settlement with a coalition of 42 state attorneys general stemming from a data breach lawsuit. The agreement resolves multistate legal action against the genetic testing company.
Why this matters: Genetic data is not like a leaked password. You cannot change your DNA. When 23andMe got breached, it exposed some of the most personal information that exists — ancestry, health predispositions, biological relatives. Millions of people trusted the company with that. The $18 million settlement sounds large until you divide it by the number of people affected. The company also went through bankruptcy and rebranded. The people whose data leaked are still the same people, with the same exposure, whether or not the corporate name changed.
Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance · Healthcare professionals
This summary is AI-assisted and may contain errors. It is an original briefing to help you gauge significance quickly — not a reproduction of the source. Always read the linked original before relying on it. See our methodology.