New Jersey will receive nearly $410,000 under a multistate settlement with bankrupt genetic testing company 23andMe after a 2023 data breach exposed the DNA and personal information of nearly 150,000 Garden State customers, Attorney General Jennifer Davenport announced today.
The agreement resolves claims brought by a bipartisan coalition of 42 attorneys general following a breach affecting roughly 6.9 million consumers worldwide, including 148,585 in New Jersey. Although the settlement allows $150 million in claims for states, recovery is limited by the available assets in 23andMe’s bankruptcy estate.
“For years, 23andMe took advantage of New Jerseyans and put their most sensitive data at risk. 23andMe obtained people’s DNA, failed to keep that sensitive genetic information secure, and then failed to tell consumers when a data breach occurred,” said Davenport. “Today’s settlement holds 23andMe accountable for its misleading statements and its failure to protect the DNA profiles of customers. We will always stand on your side against corporations that mislead the public and endanger your privacy.”
The company disclosed the breach in October 2023 after customers’ genetic ancestry information and other personal data had been exposed, with some of the stolen information later offered for sale on the dark web.
A multistate investigation found that 23andMe failed to implement basic cybersecurity protections, including safeguards against credential-stuffing attacks, intrusion prevention, monitoring tools, and adequate investigation of suspicious login activity.
The company filed for bankruptcy protection in March 2025.
As part of the proceedings, its assets, including consumer data, were sold to TTAM Research Institute, a nonprofit formed by 23andMe founder Anne Wojcicki. The sale includes enhanced data security requirements, stronger privacy protections, and continued consumer data deletion rights.