TRENTON, N.J. — New Jersey will receive nearly $410,000 as part of a multistate settlement resolving claims against genetic testing company 23andMe following a 2023 data breach that exposed the personal information of nearly 150,000 New Jersey customers, Attorney General Jennifer Davenport announced Tuesday.
Davenport joined a bipartisan coalition of 42 attorneys general in reaching the settlement with the bankruptcy trustee overseeing 23andMe’s Chapter 11 proceedings.
The settlement allows states to recover $18 million from available bankruptcy funds, although the coalition’s total allowed claims were valued at $150 million. The reduced recovery reflects the limited assets available in the bankruptcy estate and competing claims.
The 2023 breach affected 148,585 New Jersey customers and approximately 6.9 million people worldwide, exposing personal information that included, in some cases, genetic ancestry data. According to the attorney general’s office, portions of the stolen information were later offered for sale on the dark web.
“For years, 23andMe took advantage of New Jerseyans and put their most sensitive data at risk. 23andMe obtained people’s DNA, failed to keep that sensitive genetic information secure, and then failed to tell consumers when a data breach occurred,” said Attorney General Davenport. “Today’s settlement holds 23andMe accountable for its misleading statements and its failure to protect the DNA profiles of customers. We will always stand on your side against corporations that mislead the public and endanger your privacy.”
According to the investigation, 23andMe initially denied a breach had occurred before later confirming the incident and attributing it to consumers’ account settings and password practices. Attorneys general alleged the company failed to implement reasonable cybersecurity measures, including protections against credential stuffing attacks, intrusion prevention tools, monitoring systems, multifactor authentication and other safeguards designed to detect and prevent unauthorized access.
“Preventing a data breach is always better than letting one occur, especially when it comes to DNA data, the most sensitive type of information out there,” said Jeremy E. Hollander, acting director of the Division of Consumer Affairs. “As today’s settlement underscores, companies must act to protect consumers from a leak of their personal information.”
The settlement follows 23andMe’s March 2025 bankruptcy filing. As part of the bankruptcy proceedings, the company’s assets, including consumer genetic data, were sold to TTAM Research Institute, a nonprofit formed by 23andMe founder and former CEO Anne Wojcicki.
State officials said the sale includes enhanced data security and privacy requirements, including stronger security measures, ongoing risk assessments, an advisory board, compliance with privacy laws and continued consumer rights to delete their data.
Separately, 23andMe previously agreed to a $46.75 million class-action settlement to compensate affected U.S. consumers who submitted claims by Feb. 17, 2026.
