Delaware Reach Settlement in 23andMe Data Breach Case
State of DE - Attorney General Kathy Jennings has announced a settlement over the 2023 data breach at 23andMe. The breach compromised the genetic data of 6.9 million customers worldwide.
The settlement came from a multistate effort with 42 other attorneys general. It includes $150 million in allowed claims for states, though only $18 million is actually available for payout due to limited bankruptcy funds. Delaware's share of that amount is $159,654.
23andMe also agreed to a separate $46.75 million class-action settlement. That money goes to U.S. consumers who filed claims by February 17, 2026.
"Today's results show that my office will continue to hold companies like 23andMe accountable when they fail to safeguard sensitive personal data collected from Delawareans," said Attorney General Kathy Jennings. "We're going to keep using all of the tools we have, including vigorous enforcement of the Delaware Personal Data Privacy Act, to ensure Delawarean's personal data is well-protected."
The breach itself happened back in October 2023. It affected 6.9 million people worldwide, including 16,479 Delaware residents, and exposed sensitive information like genetic ancestry data.
23andMe didn't handle the situation well. The company first denied a breach had happened, then confirmed it, and later tried to blame customers for how they set up their accounts or passwords.
That response was especially frustrating given 23andMe's ties to MyHeritage. That company had its own data breach years earlier, one that exposed shared login credentials between the two platforms.
The multistate investigation turned up several security failures at 23andMe. The company had no safeguards against credential stuffing attacks, no multifactor authentication requirement, and no proper rate limiting or intrusion prevention in place.
Investigators also found 23andMe failed to monitor for unusual login activity, even during a massive spike in login attempts. Known vulnerabilities went unfixed, and design features weren't properly tested.
23andMe filed for bankruptcy in March 2025. As part of that process, its consumer data was sold to TTAM Research Institute, a nonprofit started by 23andMe founder Anne Wojcicki.
The sale came with new rules attached. TTAM agreed to stronger data security, an advisory board, compliance with privacy laws, and continued consumer deletion rights.
Delaware initially objected to the data sale during bankruptcy proceedings. The state withdrew its objection only after TTAM agreed to additional privacy protections for consumers.
If you used 23andMe's services, you can request deletion of your data. Delaware residents can also learn more about their data privacy rights at privacy.delaware.gov.
