INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

23andMe Suffers $6 Million Data Breach Lawsuit Settlement

| 2026-10-20 16:36 HIGH LOW DATA BREACH
JSON
Executive Summary
AI-generated
A data breach at 23andMe, a genetic testing company, occurred in July 2026 when approximately 6.9 million individuals, including 855,000 California residents, had their personal and genetic information exposed due to credential-based attacks that took advantage of poor password security practices among customers. The incident was attributed to the failure by 23andMe to implement appropriate data security measures as required by state laws in California. A settlement has now been agreed between 23andMe and California for $6 million, resolving claims of alleged violations of California laws. Following the breach, 23andMe filed for bankruptcy protection and was subsequently bought by TTAM Research Institute, a non-profit controlled by co-founder Anne Wojcicki, in exchange for $305 million; however, this sale is unaffected by the settlement agreement.
Technical Mitigations AI-generated
• Implement security measures for detecting and blocking attacks on customer accounts, such as 23andMe should have done to prevent credential-based attacks. • Use strong password security practices among customers to prevent credential stuffing attacks like the one that occurred in this data breach incident. • Regularly monitor customer account activity for suspicious behavior or unauthorized access attempts.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope legallegal
Incident Timeline
‎July 2026
The court approved a $6 million settlement in the California 23andMe data breach lawsuit.
‎Oct 20, 2026
California agreed to a $6 million settlement with 23andMe over the data breach that exposed personal and genetic information of approximately 6.9 million individuals, including 855,000 California residents.
industry Legal
General Document Context
tactic Data Breach
California Settles 23andMe Data Breach Lawsuit for $6 Million Posted By Steve Alder on Oct 20, 2026 In July, a coalition of 42 state attorneys general agreed to an $18 million settlement with 23andMe to resolve claims that the company violated state laws by failing to implement appropriate data security measures to prevent credential-based attacks.
general_metric 42 attorneys general
California Settles 23andMe Data Breach Lawsuit for $6 Million Posted By Steve Alder on Oct 20, 2026 In July, a coalition of 42 state attorneys general agreed to an $18 million settlement with 23andMe to resolve claims that the company violated state laws by failing to implement appropriate data security measures to prevent credential-based attacks.
financial $18 settlement
California Settles 23andMe Data Breach Lawsuit for $6 Million Posted By Steve Alder on Oct 20, 2026 In July, a coalition of 42 state attorneys general agreed to an $18 million settlement with 23andMe to resolve claims that the company violated state laws by failing to implement appropriate data security measures to prevent credential-based attacks.
organisation the HIPAA Journal
The data breach, covered by the HIPAA Journal in this post , exposed the personal information and genetic information of approximately 6.9 million individuals, including 855,000 California residents.
financial $46.75 litigation
In addition to the $24 million in settlements, 23andMe agreed to settle class action data breach litigation and will pay $46.75 million to its customers.
organisation TTAM Research Institute
Following the security incident, 23andMe filed for bankruptcy protection and the company was bought for $305 million by TTAM Research Institute, a non-profit controlled by 23andMe co-founder Anne Wojcicki.
organisation the California Genetic Information Privacy Act
California attempted to block the sale of the company, claiming it violated the California Genetic Information Privacy Act because 23andMe customers had not given their consent to the sale, which involved the transfer of their personal and genetic information to TTAM Research Institute.
organisation HIPAA Journal
Get The FREE HIPAA Compliance Checklist Immediate Delivery of Checklist Link To Your Email Address Please Enter Correct Email Address Your Privacy Respected HIPAA Journal Privacy Policy “I am proud to fight for the privacy rights of Californians and to deliver this settlement for consumers ​who put their trust in 23andMe,” said California Attorney General Rob Bonta.
financial $6 California
Under the terms of the settlement, California will be paid $6 million.
‎2026/10/20
California settled a data breach lawsuit against 23andMe for $6 million on October 20, 2026.
organisation Data Breach Lawsuit
California Settles 23andMe Data Breach Lawsuit for $6 Million.
Tactical Metrics
Metrics
financial
18,000,000
Settlement
California Settles 23andMe Data Breach Lawsuit for $6 Million Posted By Steve Alder on Oct 20, 2026 In July, a coalition of 42 state attorneys general agreed to an $18 million settlement with 23andMe to resolve claims that the company violated state laws by failing to implement appropriate data security measures to prevent credential-based attacks.
Metrics
financial
46,750,000
Financial Impact / Stolen Funds
In addition to the $24 million in settlements, 23andMe agreed to settle class action data breach litigation and will pay $46.75 million to its customers.
Metrics
financial
6,000,000
Financial Impact / Stolen Funds
Under the terms of the settlement, California will be paid $6 million.
Intelligence Sources
HIPAA Journal 2026-10-20