AUSTIN, Texas. Texas Attorney General Ken Paxton announced that the state has secured a settlement with genetic testing company 23andMe as part of its bankruptcy proceedings following a 2023 data breach that exposed the personal information of millions of customers.
The agreement resolves claims stemming from the breach, which affected approximately 6.9 million customers worldwide and exposed sensitive personal information, including genetic ancestry data for some users.
According to the Texas Attorney General's Office, 23andMe discovered the breach in October 2023, months after compromised customer information had already become publicly available. Portions of the stolen data were later offered for sale on the dark web.
State investigators said the company initially denied a breach had occurred and, after confirming the incident, attributed it to customers' account settings and password practices.
Attorney General Paxton joined a coalition of 42 states that launched a multistate investigation into the company's cybersecurity practices.
Investigators concluded that 23andMe failed to implement reasonable safeguards to protect customer data and engaged in inadequate data security practices that left sensitive information vulnerable to hackers.
In March 2025, 23andMe filed for bankruptcy protection. As part of the bankruptcy proceedings, the participating states asserted claims related to the data breach, resulting in a settlement valued at $150 million for the multistate coalition.
Because of limited assets available in the bankruptcy estate and competing claims from other creditors, only $18 million will be distributed immediately. Texas is expected to receive approximately $1.27 million from that payment.
The settlement also requires enhanced privacy and cybersecurity protections, including stronger data security standards, regular risk assessments and the creation of an independent advisory board. It also preserves consumers' rights to delete their personal data and requires compliance with applicable state privacy laws.
The protections will apply to the newly renamed 23andMe Research Institute, formerly known as the TTAM Research Institute, as it continues operating after the bankruptcy proceedings.
"The 23andMe data breach was a serious failure to protect consumers' privacy that exposed the genetic information of millions of people," Paxton said. "Companies that collect and profit from Texans' most personal information have a legal duty to protect it. This settlement sends a clear message that companies cannot cut corners on data security. It helps ensure stronger protections for consumers' genetic information moving forward."
Separately, 23andMe previously agreed to a $46.75 million class-action settlement to compensate affected U.S. consumers who filed claims before the Feb. 17, 2026, deadline.
