Maryland Attorney General Anthony G. Brown has joined a coalition of 42 attorneys general in an $18 million settlement resolving allegations related to 23andMe’s 2023 data breach.
The breach compromised information belonging to 6.9 million customers worldwide, including 94,298 Maryland residents. Exposed information included genetic ancestry data, and portions of the data were later offered for sale on the dark web.
23andMe filed for bankruptcy protection in March 2025. The settlement was reached with the Office of the United States Bankruptcy Trustee. The $18 million will be paid from available bankruptcy funds.
A multistate investigation found that 23andMe used unreasonable data security practices. The company allegedly failed to require multifactor authentication, protect against credential-stuffing attacks, monitor unusual login activity, address known vulnerabilities and properly test security features.
The breach was linked to passwords compromised during an earlier breach involving MyHeritage.com, a 23andMe partner. Some customers had used the same login credentials on both websites.
During the bankruptcy proceedings, 23andMe’s assets and consumer data were sold to TTAM Research Institute, a nonprofit created by 23andMe founder and former CEO Anne Wojcicki. The organization has since been registered as the 23andMe Research Institute.
Terms of the sale require enhanced data security measures, risk assessments, an advisory board, compliance with privacy laws and consumer data-deletion rights.
Maryland law also requires direct-to-consumer genetic testing companies to provide privacy policies, obtain consent before collecting or sharing genetic information and allow consumers to access and delete their data.
The settlement includes attorneys general from 41 states and the District of Columbia.
