23andMe Settles Data Breach Case for $18 Million

Washington state is set to receive $547,000 as part of an $18 million multistate settlement with the genetic testing company 23andMe. The payment follows a legal action brought by 42 attorneys general regarding a 2023 data breach that affected millions of users. Over 220,000 residents in Washington had their personal and genetic information exposed during the incident.

Authorities accused 23andMe of poor security practices, including a failure to prevent credential stuffing attacks and slow response times when the breach was first discovered. The company initially denied responsibility and blamed its own customers for the security failures. This settlement forces the company to update its security protocols and pay into consumer protection funds.

Beyond the state settlement, a separate $46.8 million class action agreement is moving forward to provide direct payouts to affected consumers. This case highlights the growing focus on data privacy for sensitive personal information, a topic that remains highly relevant for users of online services and digital platforms where security is paramount.

Moving forward, regulators are expected to keep a close eye on how tech companies handle sensitive user data. Consumers should monitor their accounts for notifications regarding eligibility for the separate class action claims process.