Privacy & Cybersecurity Law Blog

On July 14, 2026, Connecticut Attorney General William Tong announced that a coalition of 42 state attorneys general has reached a settlement with the bankruptcy trustee for genetic testing company 23andMe. The settlement resolves claims arising from a data breach the company disclosed in October 2023 that exposed the personal information of approximately 6.9 million customers worldwide.

The settlement follows a multistate investigation into allegations that 23andMe failed to implement reasonable security measures to protect sensitive genetic data and personal information. The investigation found that 23andMe engaged in unreasonable data security practices, including but not limited to failure to:

• employ safeguards against credential stuffing attacks, including comparing passwords against blocklists of known breached passwords and requiring multifactor authentication;
• implement appropriate rate limiting or intrusion prevention;
• implement logging and monitoring or other tools to detect a data breach;
• appropriately investigate and/or address unusual login patterns, such as a massive spike in login attempts;
• remediate known vulnerabilities; and
• properly review and test design features.

Several announcements issued by other attorneys general involved in the settlement noted that the breach was “particularly egregious” in light of 23andMe’s partnership with MyHeritage.com. The breach, which occurred as a result of “credential stuffing” (a tactic used by cybercriminals to attempt brute force access to an online account by using compromised credentials from other websites), was shown to have been related to passwords compromised years earlier as part of a breach of MyHeritage.com that exposed thousands of credentials shared between the websites.

The settlement provides for $150 million in allowed claims for participating states, although actual recovery is expected to be limited to $18 million because of limited funds in the bankruptcy estate and other claims against the estate. Connecticut is to receive approximately $887,729.

Attorney General Tong’s announcement also highlights privacy and data security commitments made by TTAM Research Institute, a nonprofit organization formed by 23andMe founder Anne Wojcicki, which purchased 23andMe's assets in bankruptcy. As a condition of the sale, TTAM Research Institute (now renamed 23andMe Research Institute) agreed to enhanced privacy and security obligations, including risk assessments, compliance with comprehensive privacy laws, continued consumer deletion rights and the addition of an Advisory Board.

Attorney General Tong further noted that Connecticut recently enacted a new genetic privacy law, effective October 1, 2026, that provides consumers with additional rights and protections related to genetic testing services. Read more about the law here.