LANSING, Mich. (WZMQ) – Michigan will receive $436,605 as part of a multistate settlement resolving bankruptcy claims against 23andMe over a 2023 data breach that compromised the genetic data of 6.9 million customers worldwide, Attorney General Dana Nessel announced.
Nessel joined a coalition of 42 attorneys general in the settlement with the bankruptcy trustee for the genetic testing company. The agreement includes $150 million in allowed claims for states, though recovery is limited to $18 million due to the finite funds available in the bankruptcy estate and numerous competing claims. Those funds will be paid out immediately.
23andMe separately agreed to a $46.75 million class-action settlement in the bankruptcy case to compensate affected U.S. consumers who filed claims before the process closed in February.
“Protecting the personal information of Michigan residents has been one of my top priorities during my time in office, and we will not stand by when companies fail to safeguard consumer data,” Nessel said. “I am proud to have worked with this coalition to secure this settlement. We remain committed to defending the privacy of Michiganders and ensuring that corporations that fail their customers are held accountable.”
23andMe disclosed in October 2023 that hackers had breached its systems, affecting 6.9 million consumers, including 162,865 Michigan residents. The breach exposed a range of customer data, in some cases including genetic ancestry information. Subsets of that data were later found for sale on the dark web.
According to the multistate investigation that followed, 23andMe did not disclose the breach until months after the compromised data was already publicly available. The company initially denied a breach had occurred, and after confirming it, blamed the incident on how customers had set up their accounts or managed their passwords.
Investigators also found the breach was worsened by 23andMe’s partnership with MyHeritage, a genealogy platform that had itself been compromised years earlier, exposing thousands of credentials shared between the two sites.
The multistate investigation identified several security failures at 23andMe, including a lack of safeguards against attacks such as blocklists for known breached passwords or multifactor authentication requirements, insufficient rate limiting and intrusion prevention, inadequate logging and monitoring systems, failure to investigate unusual login activity such as spikes in login attempts, unaddressed known vulnerabilities, and insufficient testing of design features.
23andMe filed for bankruptcy protection in March 2025. States subsequently filed claims tied to the data breach investigation. As part of the bankruptcy proceedings, the company’s assets, including its consumer genetic data, were sold to TTAM Research Institute, a nonprofit formed by 23andMe founder and former CEO Anne Wojcicki. The organization has since been renamed 23andMe Research Institute.
The terms of that sale included data security requirements similar to what likely would have been included in a direct settlement with 23andMe, including enhanced security standards, risk analysis requirements, the creation of an advisory board, compliance with applicable state privacy laws, and continued consumer deletion rights.
Nessel is also urging state lawmakers to pass Senate Bill 359, sponsored by state Sen. Rosemary Bayer, which would create the Michigan Personal Data Privacy Act. The bill would give the Department of Attorney General authority to investigate and pursue civil actions related to data privacy violations. It is currently awaiting a vote in the Michigan Senate. If passed, Michigan would join at least 23 other states that have enacted similar comprehensive privacy protections.
“Michigan consumers deserve the protections necessary to keep their personal information safe,” Nessel said. “I urge the Legislature to pass this much-needed legislation to provide meaningful, long-overdue privacy rights to Michiganders while giving my office the ability to pursue companies that compromise our residents’ data.”
Michigan residents can find more information on protecting consumer privacy and opting out of data sharing on the Department of Attorney General’s website.
