Attorney General Jeff Jackson Wins Settlement with 23andMe Over Genetic Data Protections

North Carolina to receive over $666,000 to resolve claims related to the company’s 2023 data breach.

FOR IMMEDIATE RELEASE
Tuesday, July 14, 2026
Contact: comms@ncdoj.gov
919-538-2809

RALEIGH — There is no data more personal or identifiable to a single person than our DNA. 23andMe had access to millions of people’s genetic data and didn’t do nearly enough to protect it – resulting in a massive data breach in 2023. Today, Attorney General Jeff Jackson secured an $18 million multistate settlement with the bankruptcy trustee for 23andMe resolving claims related to the company’s data breach that compromised the genetic data of 6.9 million customers worldwide. North Carolina will receive $666,242.

23andMe will also pay $46.75 million in a class-action settlement to provide relief to U.S. consumers who were affected by the data breach and submitted claims by February 17, 2026. Affected customers can learn more about the class-action settlement here.

“Your genetic data is the most personal data you have. 23andMe failed to protect it for millions of people, and when the breach happened, they pointed the finger at their own customers,” said Attorney General Jeff Jackson. “So we held them accountable to make sure that data is safe even if the company no longer exists.”

The settlement follows Attorney General Jackson’s investigation into 23andMe after the company’s 2023 data breach. The investigation found that 23andMe took months to detect the credential stuffing breach after customers’ personal information had already been exposed online. In a credential stuffing attack, hackers use stolen usernames and passwords to access accounts, where people have reused the same login credentials, to steal personal information. The company initially denied the breach and later blamed customers’ passwords and account settings for the incident. The breach exposed a range of customer information, including genetic ancestry data, and some of the stolen information was later offered for sale on the dark web.

The investigation found that 23andMe failed to protect its customers’ data when it should have been taking earlier steps to prevent data breaches, installing tools to monitor for data breaches, investigating unusual login patterns, and fixing gaps in its security practices.

Following the data breach, 23andMe filed for bankruptcy and attempted to sell the genetic data it had collected from more than 15 million customers. Attorney General Jackson joined a multistate lawsuit to prevent the company from selling customers’ genetic information without their consent. As a result, Attorney General Jackson secured protections that kept North Carolinians’ genetic data with TTAM Research Institute, a nonprofit organization created by one of 23andMe’s cofounders, instead of a for-profit third party. Attorney General Jackson also secured additional safeguards to protect consumers’ genetic data, including stronger data security requirements, regular risk assessments, the continued right for consumers to delete their data, and the creation of an advisory board.

Attorney General Jackson is joined in reaching this settlement by the Attorneys General of Alaska, Alabama, Arkansas, Arizona, Colorado, Connecticut, Delaware, the District of Columbia, Florida, Georgia, Idaho, Iowa, Illinois, Indiana, Kansas, Kentucky, Louisiana, Massachusetts, Maryland, Maine, Michigan, Minnesota, North Dakota, New Hampshire, New Jersey, New Mexico, New York, Ohio, Oklahoma, Oregon, Pennsylvania, South Carolina, South Dakota, Tennessee, Texas, Utah, Virginia, Vermont, Washington, Wisconsin, and West Virginia.

A copy of the settlement is available here.

###