23andMe Data Breach Ends in $18 Million Settlement

The 23andMe data breach has resulted in an $18 million settlement after a multistate investigation concluded that the genetic testing company failed to adequately protect customer information. The agreement follows one of the largest privacy incidents involving consumer DNA data in recent years.

The breach exposed information belonging to roughly 6.9 million users after attackers gained access to customer accounts using stolen login credentials. Although the company’s core systems were not directly hacked, the incident raised serious concerns about how sensitive genetic information was protected.

Attackers Exploited Customer Accounts

The breach began with a credential-stuffing attack. Cybercriminals used usernames and passwords stolen from unrelated data breaches to access customer accounts that reused those credentials.

Once inside, the attackers collected information available through the DNA Relatives feature. Because connected accounts shared family and ancestry details, the breach spread far beyond the accounts that were initially compromised.

The exposed information included names, ancestry reports, family connections, profile details, and other personal information linked to customer accounts.

Investigation Led to Settlement

State investigators concluded that stronger security measures could have reduced the impact of the attack.

The investigation found that additional protections, such as mandatory multi-factor authentication and improved monitoring for suspicious login activity, may have prevented many of the compromised accounts from being accessed.

Rather than continue the legal dispute, 23andMe agreed to pay $18 million to resolve the claims.

The agreement comes after the company entered bankruptcy proceedings, limiting the amount that regulators could realistically recover.

Security Changes Will Follow

The settlement is not limited to a financial payment.

23andMe must strengthen its cybersecurity program and improve the way it protects customer accounts. The company is also expected to expand security monitoring, improve risk assessments, and introduce stronger safeguards for the genetic information it stores.

These measures are intended to reduce the likelihood of similar incidents in the future.

Customers Already Have a Separate Settlement

The new agreement does not replace compensation available to affected customers.

Earlier legal proceedings resulted in a separate class-action settlement for individuals impacted by the 2023 breach. The latest agreement instead resolves enforcement actions brought by state regulators over the company’s security practices.

As a result, the financial payment announced this week addresses regulatory claims rather than individual customer damages.

Genetic Data Requires Stronger Protection

The 23andMe incident remains one of the most significant data breaches involving consumer genetic information.

Unlike passwords or credit card numbers, genetic data cannot simply be replaced after it is exposed. That reality has increased pressure on companies handling DNA information to adopt stronger security controls and better account protections.

The settlement also sends a clear message to organizations collecting highly sensitive personal data. Basic account security is no longer enough. Companies are increasingly expected to use layered defenses that can stop credential-based attacks before customer information is placed at risk.