Loading story…
A coalition of 42 U.S. state attorneys general reached an $18 million settlement with 23andMe over cybersecurity failures tied to the company’s 2023 breach, which exposed genetic and other personal information belonging to 6.9 million people. Authorities said the company failed to defend against credential-based attacks, lacked adequate intrusion prevention, did not properly log and monitor for intrusions, failed to remediate known vulnerabilities, and did not investigate unusual login activity. The settlement also imposes new security and governance requirements on the 23andMe Research Institute, which acquired the company’s assets, including genetic data, after its 2025 bankruptcy, while preserving customers’ rights to delete personal data and destroy genetic samples.
In a related bankruptcy ruling, a U.S. judge held that California cannot seek monetary damages from the company formerly known as 23andMe because its Chapter 11 reorganization plan bars those claims, though the state may still pursue non-monetary remedies. The court said California had participated in the bankruptcy case and had an earlier opportunity to challenge jurisdiction, requiring the state to amend or dismiss its lawsuit to remove claims for civil fines. The bankruptcy process also created a customer claims fund, and the court has authorized $46.75 million in total payouts connected to the breach.
See the reporting duties and controls this puts on the clock.
6 events from the most recent confirmed update back to the earliest known activity.
Spain's data protection authority AEPD fined 23andMe €2.4 million for cybersecurity and privacy failings tied to the April 2023 breach, which affected more than 2,600 people in Spain. The regulator said the company lacked adequate safeguards for sensitive genetic data and delayed notifying Spanish authorities by 12 days after learning of the incident.
A coalition of 42 U.S. state attorneys general reached an $18 million settlement with 23andMe over cybersecurity failures tied to the 2023 breach. The agreement imposes new security and governance requirements on the 23andMe Research Institute and preserves customers' rights to destroy genetic samples and delete personal data.
After 23andMe's 2025 bankruptcy, the 23andMe Research Institute acquired the company's assets, including genetic data. This acquisition later became relevant to enforcement and settlement terms tied to the breach.
A U.S. bankruptcy judge ruled that California cannot pursue monetary damages against the company formerly known as 23andMe over the 2023 breach, though non-monetary remedies may still be sought. The ruling requires the state to dismiss or amend its May 28 lawsuit to remove claims for monetary relief.
In 2023, a breach at 23andMe exposed genetic and other personal information belonging to an estimated 6.9 million customers. Authorities later said the incident was tied to cybersecurity failures including weak protections against credential-based attacks and inadequate monitoring.
On May 28, California Attorney General Rob Bonta sued the company formerly known as 23andMe, seeking potentially millions of dollars in civil fines over the 2023 breach. The suit was later affected by the company's bankruptcy proceedings.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
16 references tracked. Mallory keeps watching after this page renders.
teiss.co.uk
Open sourcecybersecuritynews.com
Open sourcetherecord.media
Open sourcehipaajournal.com
Open sourceag.ny.gov
Open sourcebusinessinsurance.com
Open source23andme.org
Open sourceaepd.es
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
California Attorney General Rob Bonta has sued 23andMe over its 2023 breach, alleging the DNA testing company failed to implement reasonable safeguards for highly sensitive customer data and misled consumers about the incident. State investigators said attackers used a credential-stuffing campaign against roughly 14,000 accounts over about five months, ultimately exposing the personal and genetic information of 6.9 million people, including 855,541 California residents. The compromised data reportedly included genetic predispositions, health risk factors, ancestry, ethnicity, and biological-relative information. The complaint alleges 23andMe failed to defend against a well-known attack technique, overlooked warning signs such as spikes in login attempts and public discussion of the breach, and left additional weaknesses in its **DNA Relatives** feature. Bonta also said the stolen data was later advertised for sale on the dark web with references to **Asian American Pacific Islander** and **Jewish** users, heightening concerns about targeted harm. The lawsuit follows a class-action settlement approved in January 2026 for up to **$50 million**, and comes as California separately challenges the sale of consumers’ genetic data and biological samples in 23andMe’s bankruptcy case.
Jun 29, 2026
23andMe, now operating as Chrome Holding, has secured a $16.5 million settlement from its cyber insurers as part of its Chapter 11 bankruptcy proceedings. The agreement involves the insurers buying back unused cyber insurance coverage, with the funds earmarked to pay creditors whose claims are covered by the company's cyber policies, including those related to ongoing cyberattack litigation. The settlement also stipulates that Chrome will indemnify the insurers for claims up to the settlement amount and release them from further obligations related to the policies. The bankruptcy court approved the settlement, which is part of a broader restructuring that included the sale of 23andMe's Personal Genome Service and Research Services business lines to TTAM Research Institute for $305 million. Under TTAM's ownership, 23andMe continues to provide DNA health and ancestry testing services. The settlement provides a mechanism for addressing outstanding cyber-related claims as the company navigates its financial and legal challenges.
Jun 29, 2026
Labcorp agreed to pay **$35 million** to settle class-action litigation tied to the 2018–2019 cyberattack on its former billing vendor, American Medical Collections Agency, operated by Retrieval-Masters Credit Bureau. Labcorp said the incident affected nearly **10.3 million patients** whose personal information had been sent to AMCA and was present in the vendor’s systems between August 2018 and March 2019. Exposed data included **Social Security numbers**, payment card information, and in some cases medical test names and diagnostic codes. Under the proposed settlement, eligible class members can seek reimbursement of documented losses of up to **$5,000**, an estimated pro-rata cash payment of about **$50**, and **two years of medical and healthcare information monitoring**. Labcorp denied wrongdoing, and a final fairness hearing is scheduled in New Jersey federal court on Aug. 20. The AMCA breach affected roughly **24 million people** across dozens of clients, also hit Quest Diagnostics and BioReference Laboratories, contributed to AMCA’s 2019 bankruptcy, and previously led to a 2021 multistate settlement with **41 state attorneys general**.
Jun 29, 2026