A 42-state coalition reached an $18 million settlement with 23andMe’s bankruptcy trustee over allegations tied to the genetic-testing company’s 2023 data breach, according to Washington’s attorney general.

What happened

Washington will receive $547,000 as part of an $18 million multistate settlement with the bankruptcy trustee for 23andMe over allegations arising from a 2023 data breach that compromised genetic data of more than 220,000 customers in the state, the Washington Attorney General’s Office announced July 14.

The deal, announced by a coalition of 42 attorneys general, directs Washington’s share toward enforcement of the state’s consumer protection laws. The attorney general’s release also said 23andMe agreed to a $46.8 million class-action settlement in the bankruptcy to provide relief to affected U.S. consumers who submitted claims by Feb. 17, 2026, a claims process the release said is now closed.

Washington Attorney General Nick Brown framed the settlement as an accountability measure for companies handling sensitive consumer data. “23andMe presented itself as a safe steward of Washingtonians’ most sensitive personal data and then failed to ensure protection against hackers,” Brown said, according to the release.

The AG’s office said 23andMe announced in October 2023 that it had discovered a breach affecting 6.9 million consumers, including 221,401 in Washington. The breach exposed a range of customer data, including in some cases genetic ancestry information, and subsets of the data were later published for sale on the dark web, according to the release.

The state release said the multistate investigation found unreasonable data-security practices, including alleged failures to guard against credential-stuffing attacks, require multifactor authentication, use appropriate rate limiting or intrusion prevention, implement logging and monitoring likely to detect a breach, address unusual login patterns, remediate known vulnerabilities and properly review and test design features.

The settlement comes in the shadow of 23andMe’s bankruptcy proceedings. The Washington AG’s office said 23andMe filed for bankruptcy protection in March 2025 and that states later filed claims related to the data-breach investigation. As part of the bankruptcy, the company’s assets, including consumer data, were sold to TTAM Research Institute, a nonprofit formed by 23andMe founder and former CEO Anne Wojcicki.

According to the AG’s office, the sale terms included data-security and privacy conditions that likely would have been part of a settlement had 23andMe not filed for bankruptcy. Those terms included enhanced data-security requirements, risk analysis, an advisory board, agreement to be bound by comprehensive privacy laws without exception, and continued consumer deletion rights.