States Claimed $150M From 23andMe's Breach. They Got $18M.
Summary
A year after a federal bankruptcy judge approved 23andMe's sale of its assets for $305 million -- predicting the deal "may allow them to pay all creditors in full" -- a coalition of 42 state attorneys general has settled its own bankruptcy claim over the company's 2023 genetic-data breach. The claim was worth $150 million, the states say. What they'll actually collect is $18 million: 12 cents on the dollar, blamed on "the finite amount of funds in the bankruptcy estate and numerous other claims." A separate consumer class-action fund fared differently -- it grew, from $30 million agreed before the bankruptcy to $46.75 million after it.
"It may allow them to pay all creditors in full"
23andMe filed for Chapter 11 bankruptcy on March 23, 2025. Its court-supervised auction opened at $52 million; Regeneron Pharmaceuticals initially won it at $256 million; then TTAM Research Institute -- a nonprofit founded by 23andMe co-founder Anne Wojcicki -- came back with more. On June 13, 2025, TTAM's $305 million bid, nearly six times the opening offer, was declared the winner. Approving the sale two weeks later, the bankruptcy court itself wrote⧉ that the deal "will produce more than $300 million for their creditors, and it may allow them to pay all creditors in full."
More than 30 states and the District of Columbia had objected to that sale on privacy grounds, worried about what a change of ownership meant for millions of people's genetic data. Most withdrew their objections before the sale closed. A year later, the states came back -- not over privacy this time, but over money -- and settled a $150 million claim for $18 million.
View data as table
| Allowed claim | 150,000,000 | what the states say 23andMe owed them |
|---|---|---|
| Actual payout | 18,000,000 | 12 cents on the dollar -- bankruptcy estate's limited funds, per the states |
How the breach happened
23andMe announced in October 2023 that it had discovered a breach -- but only months after the stolen data was already public⧉. The attackers used "credential stuffing": testing passwords stolen from other, unrelated breaches against 23andMe accounts, betting that customers had reused them. South Carolina's attorney general traced some of those passwords to a much earlier breach at MyHeritage, a genealogy site that once shared login credentials with 23andMe. The company's first response, per the states, was to deny a breach had occurred; once it confirmed one, it blamed customers for how they'd set up their accounts.
Four states, four checks
The $18 million is split among all 42 jurisdictions by formula, roughly tracking each state's number of affected residents. North Carolina's $666,242 is the largest single share this outlet found publicly disclosed; New York, with the most affected residents of the states that released a figure (305,245), gets just over $705,000. Pennsylvania (192,093 residents) gets $491,902. South Carolina (80,181 residents) gets $280,000. None of it is a check to an individual breach victim -- it's money to state governments, the kind of recovery an attorney general's office typically books as enforcement proceeds, not consumer restitution.
View data as table
| North Carolina | 666,242 | residents affected not disclosed |
|---|---|---|
| New York | 705,000 | 305,245 residents affected |
| Pennsylvania | 491,902 | 192,093 residents affected |
| South Carolina | 280,000 | 80,181 residents affected |
The fund that grew
Consumers themselves have a separate track, and it moved the other way. Before 23andMe filed for bankruptcy, class-action lawyers had already negotiated a $30 million settlement fund, signed September 5, 2024, to resolve the consolidated federal litigation over the same breach. After the bankruptcy, that fund was renegotiated upward: the states' own releases put the final figure at $46.75 million⧉, with a claim deadline of February 17, 2026. The court-authorized settlement site confirms that date, along with a January 20, 2026 final-approval hearing. Individual claims, per legal-industry reporting on the plan administrator's process, have ranged from $50 to $10,000 depending on the harm claimed.
- 23andMe's assets sold for $305 million in June 2025; the bankruptcy court approving the sale predicted it could pay creditors in full.
- A year later, a 42-jurisdiction coalition of state attorneys general settled its $150 million bankruptcy claim over the 2023 data breach for $18 million -- 12 cents on the dollar -- citing the estate's limited funds and competing claims.
- That $18 million goes to state governments in shares tied to each state's affected-resident count, not directly to breach victims: North Carolina ($666,242), New York (>$705,000, 305,245 residents), Pennsylvania ($491,902, 192,093 residents), and South Carolina ($280,000, 80,181 residents) are the shares this outlet found publicly disclosed.
- A separate consumer class-action fund moved the opposite direction, growing from $30 million (agreed before the bankruptcy) to $46.75 million (after it), with a February 17, 2026 claim deadline.
- The breach itself, discovered by 23andMe in October 2023 months after the data was already public, exploited passwords reused from an earlier, unrelated breach at genealogy partner MyHeritage.
The states' $150 million figure is the allowed value of their bankruptcy claim, not an independent damages estimate this outlet verified; none of the attorneys general's releases itemize how that figure was calculated. The 21%-of-sale-price and per-person comparisons in this piece are this outlet's own recomputations (see analysis.json) -- the $305 million sale proceeds were also subject to secured debt, administrative expenses, and other creditor classes with priority over both the states' claim and the consumer class fund, a waterfall this outlet did not itemize because the source documents do not break it out. Coordinates for four state shares (New York, Pennsylvania, South Carolina, North Carolina) are the only ones this outlet found stated in a state attorney general's own release by the time of publication; other coalition members' shares were not independently confirmed.
Sources(10) ▾
- U.S. Bankruptcy Court, Eastern District of Missouri, Eastern Division, Memorandum Opinion Approving Sale of Substantially All Assets to TTAM Research Institute, In re 23andMe Holding Co., Case No. 25-40976-357 (2025-06-27) — The bankruptcy court's own memorandum opinion approving 23andMe's sale of substantially all its assets to TTAM Research Institute, addressing objections from more than 30 states and the District of Columbia. Source for the auction history (opening bid, Regeneron's initial winning bid, TTAM's final $305 million bid), the court's own prediction that the sale could pay creditors in full, and the states' privacy objections. Fetched directly as a PDF and read in full (via pdftotext). moeb.uscourts.gov · original document
- 23andMe Holding Co. (Chrome Holding Co.), filed with the U.S. Securities and Exchange Commission, Global Notes and Statements Regarding the Debtors' Monthly Operating Report (Exhibit 99.2 to Form 8-K), In re 23andMe Holding Co., Case No. 25-40976-357 (2025-06-13) — EDGAR exhibit reproducing a bankruptcy-court monthly operating report filed under the debtors' Chapter 11 case. Confirms the case caption, Case No. 25-40976-357, the March 23, 2025 petition date, and the joint administration of the debtor entities in the U.S. Bankruptcy Court for the Eastern District of Missouri. Fetched directly and read in full. sec.gov
- U.S. District Court for the Northern District of California (filed by Class Counsel and 23andMe's counsel), Class Action Settlement Agreement and Release, In re: 23andMe, Inc. Customer Data Security Breach Litigation, MDL No. 3098, Case No. 3:24-md-03098-EMC (N.D. Cal.) (2024-09-05) — The original, pre-bankruptcy class-action settlement agreement (Exhibit A to a September 12, 2024 court filing, case caption and ECF stamp visible on every page), executed September 5, 2024, months before 23andMe's Chapter 11 filing. Source for the original $30,000,000 Qualified Settlement Fund figure and the litigation's procedural history (MDL centralization, mediation sessions, presiding judge). Mirrored by a legal-news document archive rather than hosted on a .gov domain; the document's own case caption and Bates-style docket stamp ("Case 3:24-md-03098-EMC Document 103-2 Filed 09/12/24") match the case referenced across multiple state attorneys general's official releases, and the $30-50 million original-fund range is independently corroborated by Bloomberg Law's bankruptcy-court reporting. Fetched directly as a PDF and read in full (via pdftotext). classaction.org
- Kroll Settlement Administration LLC (court-authorized settlement administrator, In re: 23andMe, Inc. Customer Data Security Breach Litigation), 23andMe Data Settlement -- Important Documents and Dates (2026-07-19) — The official, court-authorized settlement website ("This website is authorized by the Court, supervised by counsel to the Parties, and controlled by the Settlement Administrator approved by the Court"). Source for the February 17, 2026 claim-form deadline, the January 20, 2026 final-approval hearing date, and the administrator's public contact channel (phone, mail, online form) used for this article's call-to-action. Fetched directly and read in full. 23andmedatasettlement.com
- Office of the Texas Attorney General (Ken Paxton), Attorney General Paxton Secures $150 Million Settlement Against 23andMe Over Data Breach That Exposed Genetic Information of 6.9 Million People (2026-07-15) — Official press release from the Texas Attorney General's office, one of the 42-jurisdiction coalition announcing the bankruptcy-claim settlement. Source for the $150 million total settlement figure, the 6.9 million worldwide consumer count, and the breach's discovery/disclosure timeline (23andMe learned of the breach months after data was public, initially denied it, then blamed customers). Fetched directly and read in full. texasattorneygeneral.gov · original document
- Office of the New York State Attorney General (Letitia James), Attorney General James Secures $18 Million From 23andMe for Failing to Protect Customers' Genetic Data (2026-07-14) — Official New York Attorney General press release. Source for New York's specific settlement share (more than $705,000), the 305,245 New York residents affected, and the coalition's data-security allegations against 23andMe (failure to guard against credential-based attacks, no rate limiting or intrusion detection, no monitoring of unusual logins). Fetched directly and read in full. ag.ny.gov · original document
- Pennsylvania Office of Attorney General (Dave Sunday), AG Sunday Announces $18 Million National Settlement with 23andMe Over Genetic Data Breach (2026-07-14) — Official Pennsylvania Attorney General press release. Source for Pennsylvania's $491,902 settlement share, the 192,093 Pennsylvania residents affected, the $46.75 million consumer class-action figure and its February 17, 2026 claim deadline, the "credential stuffing" attack-mechanism description, and the 42-state coalition count. Fetched directly and read in full. attorneygeneral.gov · original document
- South Carolina Attorney General's Office (Alan Wilson), Attorney General Alan Wilson Announces Multistate Settlement of Bankruptcy Claims Against 23andMe Over Genetic Data Breach (2026-07-17) — Official South Carolina Attorney General press release. Source for the exact language explaining the payout shortfall ("the finite amount of funds in the bankruptcy estate and numerous other claims"), South Carolina's $280,000 share and 80,181 affected residents, and the detail that the credential-stuffing attack exploited passwords reused from an earlier, unrelated MyHeritage breach. Fetched directly and read in full. scag.gov
- North Carolina Department of Justice (Attorney General Jeff Jackson), Attorney General Jeff Jackson Wins Settlement with 23andMe Over Genetic Data Protections (2026-07-14) — Official North Carolina Department of Justice press release. Source for North Carolina's $666,242 settlement share -- the largest single-state share this outlet found publicly disclosed -- and confirmation that the coalition comprised 41 states plus the District of Columbia (42 jurisdictions total). Fetched directly and read in full. ncdoj.gov
- Office of the Maryland Attorney General (Anthony G. Brown), Attorney General Brown Announces Multistate Settlement of Bankruptcy Claims Against 23andMe Over Genetic Data Breach (2026-07-14) — Official Maryland Attorney General press release. Source for the coalition's plain statement of the recovery constraint ("the bankruptcy estate has limited funds and there are many competing claims") and the 94,298 Maryland residents affected. Fetched directly and read in full. oag.maryland.gov
Comments
Always open. Logged-in readers can annotate paragraphs in place.
A coalition of 42 state attorneys general says 23andMe owes them $150 million over the genetic-testing company's 2023 data breach, which exposed the personal information of 6.9 million people worldwide. The settlement they announced in mid-July 2026 pays them $18 million -- 12 cents on the dollar. The stated reason: "the finite amount of funds in the bankruptcy estate and numerous other claims." That estate had sold 23andMe's assets a year earlier for $305 million.