RALEIGH, N.C. (WHKY) — North Carolina Attorney General Jeff Jackson has announced an $18 million multistate settlement with the bankruptcy trustee for genetic testing company 23andMe following the company’s 2023 data breach that exposed the personal and genetic information of millions of customers. North Carolina will receive $666,242 as part of the settlement.

State investigators found that 23andMe failed to take adequate steps to protect customer data before hackers carried out a credential stuffing attack that compromised information belonging to approximately 6.9 million customers worldwide. The breach exposed sensitive data, including genetic ancestry information, after cybercriminals used stolen usernames and passwords from other websites to gain access to customer accounts.

According to the Attorney General’s Office, the company took months to detect the breach, initially denied it had occurred, and later blamed customers for reusing passwords instead of addressing shortcomings in its own cybersecurity practices.

“Your genetic data is the most personal data you have,” Attorney General Jeff Jackson said. “23andMe failed to protect it for millions of people, and when the breach happened, they pointed the finger at their own customers. So we held them accountable to make sure that data is safe even if the company no longer exists.”

Following the breach, 23andMe filed for bankruptcy and sought to sell assets that included genetic information from more than 15 million customers. North Carolina joined a multistate lawsuit that blocked the sale of customers’ genetic data without their consent.

As part of that effort, customers’ genetic information will remain with TTAM Research Institute, a nonprofit organization established by one of 23andMe’s co-founders, instead of being transferred to a for-profit buyer. The agreement also requires stronger cybersecurity protections, regular risk assessments, preserves customers’ right to delete their data, and creates an advisory board to oversee data protection.

The announcement also highlights a separate $46.75 million class-action settlement available to eligible U.S. customers affected by the breach who submitted claims before the February 17, 2026, deadline. North Carolina joined more than 40 other states and the District of Columbia in reaching the settlement, marking one of the largest multistate actions involving the protection of consumers’ genetic data.

[Story courtesy of North Carolina Department of Justice]