Minnesota, North Dakota among 42 states in settlement with 23andMe over 2023 genetic data breach
Minnesota to receive more than $514,000; North Dakota to receive $150,380 after breach affecting millions
ST. PAUL, Minn. (Valley News Live) — Minnesota Attorney General Keith Ellison and North Dakota Attorney General Drew Wrigley are among 42 state attorneys general who have reached a settlement with the bankruptcy trustee for 23andMe, resolving claims stemming from a 2023 data breach that compromised the genetic data of 6.9 million customers worldwide.
The settlement totals $18 million — a fraction of the at least $100 billion in damages the states originally sought. Minnesota will receive $514,871 and North Dakota will receive $150,380. The settlement still requires court approval, with a hearing scheduled for August 10, 2026.
The breach, which occurred in October 2023, exposed genetic ancestry information for millions of customers, including 92,385 in Minnesota. Subsets of that data were later published for sale on the dark web.
Investigators found that 23andMe initially denied the breach and, once it confirmed the breach, blamed customers for how their accounts were set up or how they used their passwords. The multistate investigation found that the company failed to employ basic data security safeguards, including protections against credential-stuffing attacks and multifactor authentication requirements.
“When we share our sensitive data with a company, we do so with the understanding that the company will safeguard it,” Ellison said. “23andMe broke that trust. This settlement sends a message to any company we trust with our information — if you don’t hold our personal data securely, you will be held accountable.”
23andMe filed for bankruptcy in March 2025. As part of the bankruptcy proceedings, the company’s consumer data was sold to TTAM Research Institute, a nonprofit formed by 23andMe founder and former CEO Anne Wojcicki, now reregistered as 23andMe Research Institute. Under the settlement, the wind-down debtor is prohibited from direct consumer sales for five years and from collecting personally identifiable information for five years.
A separate $47 million class-action settlement for consumers is also part of the bankruptcy proceedings.
Copyright 2026 KVLY. All rights reserved.
