23andMe data breach: Minnesota to receive $514K after genetic data exposed

(FOX 9) - Minnesota is set to receive a major payout after a massive genetic data breach involving 23andMe affected thousands of residents.

23andMe data breach settlement

What we know:

Minnesota Attorney General Keith Ellison announced on Tuesday that the state will receive $514,871 as part of an $18 million recovery from 23andMe’s bankruptcy estate.

The settlement comes after a 2023 data breach that compromised the genetic data of 6.9 million customers worldwide, including 92,385 in Minnesota.

Dig deeper:

The breach exposed sensitive customer information, including genetic ancestry data, and some of this information was later found for sale on the dark web.

After the breach, 23andMe initially denied wrongdoing, instead later blaming users for their account setups and passwords.

The breach was also not discovered by 23andMe until months after personal information had already been made public.

The company filed for bankruptcy protection in March 2025, and the states filed claims related to the breach as part of those proceedings.

What they're saying:

Following the breach, Ellison and attorneys general from 41 other states began a multistate investigation, concluding that 23andMe failed to use reasonable data security measures, including "not using safeguards against credential stuffing attacks, not requiring multifactor authentication, and not monitoring for suspicious login activity," according to a press release.

Investigators also reportedly found that 23andMe did not address known vulnerabilities or properly review and test its security systems.

What's next:

In addition to the state settlement, 23andMe agreed to a $47 million class-action settlement for consumers as part of the bankruptcy case.