23andMe to pay $18 million after 43 states found 'flimsy' security let hackers steal 6.9 million profiles

Key points

• 23andMe, now trading as Chrome Holding Co., will pay $18 million to settle claims from 43 US state attorneys general over its 2023 data breach.
• Hackers stole personal and genetic ancestry data on 6.9 million customers between April and September 2023, using stolen passwords from other sites.
• New York Attorney General Letitia James said the company lacked basic safeguards, including multifactor authentication and password blocklisting.
• 23andMe paid $30 million in September 2024 to settle a class action, and the UK's Information Commissioner's Office fined it £2.31 million in June 2025.
• The TTAM Research Institute, led by co-founder Anne Wojcicki, bought the company's assets for $305 million in July 2025 after a March 2025 bankruptcy filing.

The genetic testing company 23andMe has agreed to pay $18 million to settle a joint investigation by 43 state attorneys general into the 2023 breach that exposed DNA and family history data on nearly seven million customers. The settlement, announced by New York Attorney General Letitia James, caps a multistate probe that found 23andMe left customer accounts wide open to a fairly basic form of attack.

Between April and September 2023, criminals ran a credential stuffing attack: they took usernames and passwords leaked from other websites and tried them, in bulk, on 23andMe accounts. Customers who'd reused a password were compromised instantly. The intrusion ran for five months before anyone at 23andMe noticed. By the time it was disclosed in October 2023, hackers had scraped data on 6.9 million people, including genetic ancestry information, chunks of which later appeared for sale on dark web forums.

Why did the attack work?

23andMe didn't have the ordinary defences you'd expect at a company holding this kind of data.

Investigators found the firm wasn't using multifactor authentication, the extra login step (usually a code sent to your phone) that stops a stolen password from being sufficient on its own. It also had no password blocklist to reject weak or already-leaked credentials, no meaningful rate limiting to slow automated login attempts, and no working breach-detection monitoring. Our 8 July 2026 story on how credential stuffing is fading as passkeys go mainstream is worth reading alongside this one: the defences 23andMe skipped are exactly the baseline the industry has been debating for years.

James said 23andMe also ignored unusual login activity and failed to fix known flaws in its own systems. When customers first raised the alarm, the company denied a breach had occurred, then blamed customers for reusing passwords.

"Companies have a duty to protect their customers' personal information from hackers, but 23andMe put millions of its customers at risk with its flimsy security measures," James said.

What does the settlement actually change?

Beyond the $18 million payment, the deal forces the buyer of 23andMe's assets, now operating as TTAM, to put real security controls in place: a data security advisory board, formal risk analysis procedures, and a continued right for customers to delete their genetic data on request.

This isn't the first bill 23andMe has paid. In September 2024 the company agreed to a $30 million class action settlement. The UK's Information Commissioner's Office fined 23andMe £2.31 million (about $3.12 million) in June 2025 for what it called "serious security failings" behind a "profoundly damaging" breach. The company filed for Chapter 11 bankruptcy in March 2025; four months later, the TTAM Research Institute, a nonprofit led by co-founder Anne Wojcicki, completed a $305 million purchase of the business and has since re-registered as the 23andMe Research Institute.

What the total bill actually signals is that genetic data carries regulatory risk in a different category from a leaked email list. Regulators on both sides of the Atlantic have now independently decided this breach warranted serious financial consequences, and the bankruptcy didn't make those consequences go away.

Should you worry?

If you ever used 23andMe, assume your login details and at least some profile data are in circulation. Change your 23andMe password and any other account where you reused it. Turn on multifactor authentication in your account settings. You can also request deletion of your genetic data, a right the settlement preserves. Watch for phishing emails referencing genuine details from your ancestry results: that specificity makes scam messages far more convincing than generic ones.