Wisconsin to receive $275K in 23andMe data breach settlement

MADISON, Wis. (WBAY) — The Wisconsin Department of Justice and a coalition of 41 other states have announced a settlement with the bankruptcy trustee for 23andMe, resolving allegations stemming from a 2023 data breach that compromised the genetic data of 6.9 million customers worldwide. Wisconsin will receive more than $275,000.

The settlement

The settlement includes $150 million in allowed claims for states. Due to the finite amount of funds in the bankruptcy estate and other claims, recovery is limited to $18 million, which will be paid out of available bankruptcy funds. Wisconsin’s share is more than $275,000.

23andMe also agreed to a separate $46.75 million class-action settlement to provide relief to affected U.S. consumers who submitted claims by Feb. 17, 2026. Wisconsin users who were notified they were part of the breach would receive any payments through that class-action settlement, not from the money going to the state.

“Companies that are responsible for sensitive genetic information need to keep it safe,” Attorney General Josh Kaul said. “By acting proactively, companies can help prevent data breaches.”

The breach

In October 2023, 23andMe announced it had discovered a data breach affecting 6.9 million customers, including 78,407 in Wisconsin. The breach exposed customer data including, in some cases, genetic ancestry information. Subsets of that data were subsequently published for sale on the dark web.

Investigators alleged 23andMe did not learn about the breach until months after impacted personal information was publicly available. The company initially denied a breach and, once it confirmed one, allegedly blamed consumers for how their accounts were set up or how passwords were used.

Alleged security failures

A multistate investigation found that 23andMe allegedly engaged in unreasonable data security practices, including:

• Failing to employ safeguards against cyberattacks, including comparing passwords against blocklists of known breached passwords or requiring multifactor authentication
• Failing to implement appropriate rate limiting or intrusion prevention
• Failing to implement logging and monitoring or other tools likely to detect a data breach
• Failing to appropriately investigate and address unusual login patterns, including a spike in login attempts
• Failing to remediate known vulnerabilities
• Failing to properly review and test design features

Bankruptcy and data sale

In March 2025, 23andMe filed for bankruptcy protection. As part of the bankruptcy proceedings, the company’s assets — including its consumer data — were sold to TTAM Research Institute, a nonprofit formed by 23andMe founder and former CEO Anne Wojcicki. The organization has since been reregistered as 23andMe Research Institute.

Terms of the sale included enhanced data security requirements, appropriate risk analysis, the addition of an advisory board, agreement to be bound by comprehensive privacy laws without exception, and continuing to offer consumer deletion rights.