23andMe to Pay $18 Million in Genetics Data Breach Settlement

Genetic testing company 23andMe has agreed to pay $18 million to settle claims brought by a coalition of 43 state attorneys general. The settlement addresses allegations that the company failed to implement reasonable security measures to protect sensitive customer genetic information. This agreement follows a significant data breach that exposed the personal data of millions of 23andMe users.

The attorneys general argued that 23andMe's inadequate data security practices led to the unauthorized access and potential misuse of highly personal genetic information. The settlement aims to provide restitution to affected consumers and compel the company to enhance its data protection protocols. The investigation into the breach was led by the attorneys general of California, Massachusetts, and New York.

In addition to the financial penalty, 23andMe has committed to implementing specific security enhancements and practices outlined in the settlement agreement. These measures are designed to prevent future data breaches and ensure greater protection of customer privacy. The company has also agreed to provide regular reports to the attorneys general on its compliance with these new security standards. The settlement does not represent an admission of liability by 23andMe, but rather a resolution to the claims brought against it.

The data breach, which occurred in late 2023, involved unauthorized access to customer accounts, leading to the exposure of genetic data, ancestry reports, and other personally identifiable information. The attackers exploited vulnerabilities to gain access to a large volume of user data. This settlement underscores the increasing scrutiny and regulatory pressure on companies handling sensitive personal information, particularly genetic data, which is considered highly sensitive and permanent.