Arizona receives slice of 42-state, $18M settlement over 23andMe genetic data breach

Arizona Attorney General Kris Mayes announced Tuesday that the state will receive $612,269 in civil penalties as part of an $18 million multistate settlement with the bankruptcy trustee for 23andMe.

The settlement resolves claims tied to a 2023 data breach that exposed the genetic data of 6.9 million customers worldwide, including more than 143,000 Arizonans.

“23andMe recklessly exposed Arizonans’ sensitive genetic data to hackers, allowing it to end up on the dark web,” Mayes said. “This settlement, combined with private class-action settlements, brings some measure of accountability, but companies that hold such sensitive information must do a better job protecting the data of consumers.”

A group of 42 attorneys general filed $150 million in claims against 23andMe, but only $18 million is available for immediate payout from the company’s limited bankruptcy estate. The genetic testing company also agreed to a separate $46.75 million class-action settlement with affected U.S. consumers.

The breach exposed a wide range of customer data, including genetic ancestry information. Some of that data later appeared for sale on the dark web. Investigators said that 23andMe failed to detect the breach until months after the stolen information became publicly available.

Arizona is one of the few states with a law specifically governing genetic data. The Arizona Genetic Information Privacy Act was designed to cover direct-to-consumer genetic testing companies like 23andMe. Those businesses often fall outside the healthcare privacy rules that protect patient records at hospitals and doctors’ offices.

23andMe filed for bankruptcy protection in March 2025.

As part of the proceedings, the company’s assets, including its vast database of consumer genetic data, were sold to a nonprofit formed by 23andMe founder and former CEO Anne Wojcicki.

Under the settlement, the new entity agreed to put stronger data safeguards in place, establish an independent advisory board and continue to honor consumer requests to delete their data.

Related

Maricopa County Library District celebrates opening of new West Valley branchBygone mall favorite Hot Dog on a Stick plans return to ArizonaCentral Arizona Project president says feds ‘bought the lies’ on Colorado River planGlendale Police ask for help identifying car involved in hit-and-run that killed bicyclistArizona joins 22-state lawsuit to block federal insurance rule that would gut ACA protectionsWoman hospitalized with leg injury after rescued from Papago Mountain’s Hole in the Rock