Key Point: A multistate coalition of 42 state AGs reached a landmark $150 million settlement with 23andMe over a 2023 data breach affecting 6.9 million customers, marking the largest AG multistate settlement involving consumer genetic data to date. This resolution signals heightened regulatory scrutiny of genetic data security practices and establishes a precedent for state enforcement authority in bankruptcy proceedings.

I. Background

On July 14, 2026, a multistate group of 42 state attorneys general (AGs) announced a $150 million settlement with direct-to-consumer genetic data testing company 23andMe related to a 2023 data breach involving 6.9 million customers’ data. The actual settlement funds, however, are limited to $18 million to be split among the states due to related bankruptcy proceedings involving the company. As part of the settlement terms, affected consumers may also file claims for potential monetary restitution. The resolution represents the largest AG multistate settlement involving a breach of consumer genetic data and marks an unprecedented AG intervention in bankruptcy proceedings that will have an impact on similarly situated companies in the future.

Between late April and September 2023, 23andMe suffered an orchestrated attack by cybercriminals through a technique called “credential stuffing” — a type of brute force attack, involving exploitation of compromised usernames and passwords to gain unauthorized access to user accounts. The attackers successfully compromised approximately 14,000 individual accounts with this tactic and moved through 23and Me’s network, leading to the exposure of approximately 6.9 million individuals’ personal information — including name, sex, date of birth, genetic information, predicted relationships with genetic matches, ancestry reports, ancestors’ birth locations and family names, family tree information, profile pictures, and geographic location.

II. Investigation and Settlement

In October 2023, 23andMe confirmed the breach publicly, and the multistate AG group initiated an investigation that same month. As reported by state AGs in recent press releases about this matter, the coalition determined that 23andMe allegedly engaged in unreasonable data security practices, including, but not limited to:

• Failing to employ safeguards against cyber attacks, including comparing passwords against blocklists of known breached passwords or requiring multifactor authentication;
• Failing to implement appropriate rate limiting or intrusion prevention;
• Failing to implement logging and monitoring or other tools likely to detect a data breach;
• Failing to appropriately investigate and/or address unusual login patterns, including, for example, a massive spike in login attempts;
• Failing to remediate known vulnerabilities; and
• Failing to properly review and test design features.

Beyond the state AG investigation, the company also faced regulatory investigations by Canadian authorities, received a £2.31 million fine from the UK Information Commissioner’s Office, and reached a $30 million class action settlement in September 2024.

III. Bankruptcy

In March 2025, the company filed a voluntary petition for Chapter 11 bankruptcy protection in the U.S. Bankruptcy Court for the Eastern District of Missouri, with its CEO resigning upon filing. The state AGs issued urgent consumer alerts in response and ultimately intervened in the bankruptcy proceedings to ensure the security of genetic data belonging to approximately 15 million customers. The bankruptcy court approved the sale of 23andMe to TTAM Research Institute in July of 2025. The terms of the sale included enhanced data security requirements, independent advisory board oversight, comprehensive privacy law compliance, and preserved consumer data deletion rights — conditions negotiated in part by the multistate AG group.

IV. Takeaways

A. Messaging Matters – the Importance of Communications in Breach Response

Communications during a breach response continue to be an area of heightened focus in regulatory investigations and litigation. The substance of those communications, their timing, and the audiences they reach will all be examined by internal and external stakeholders. Where statements lack accuracy relative to known facts, or are inconsistent across audiences, the consequences can be significant.

The plaintiffs’ complaint emphasizes the deficient external communications following the breach, criticizing how it addressed regulators, consumers, and the media; state AGs part of the coalition appear to share that view. Many of the state AG press releases issued in connection with the breach and subsequent settlement suggest that 23andME initially sought to deflect responsibility, shifting blame onto consumers rather than accepting accountability — a narrative that appears to track directly from the company’s own response communications.

B. Bankruptcy Does Not Extinguish Regulatory Obligations, and Data Acquirers Are Not Exempt

The combination of genetic data breaches and related bankruptcy proceedings present unprecedented conditions that will impact future AG investigations. Significantly, the AGs secured both monetary claims and forward-looking conduct requirements, demonstrating that bankruptcy discharge does not fully extinguish state enforcement authority. Indeed, TTAM Research Institute must comply with ongoing regulatory oversight and enhanced data security requirements, establishing a model where data acquirers in bankruptcy must accept regulatory obligations as a condition of receiving sensitive consumer data.

C. Regulators are Paying Close Attention to How Genetic Information Is Handled

Additionally, the coalition’s specific focus on genetic information foreshadows a more aggressive state AG enforcement posture toward biometric and genomic data handlers, particularly under proliferating state genetic privacy laws. States including California, Texas, Florida, Indiana, and Virginia have enacted such laws establishing specific requirements to collect and maintain this type of information. Other states are considering similar legislation, signaling that state AGs will continue heightened scrutiny of genetic data handling practices. Stay tuned to Troutman’s Regulatory Oversight Blog as we continue to provide pertinent updates in this area.

---

Troutman Pepper Locke State Attorneys General Team

	Ashley Taylor – Co-leader and Firm Vice Chair Ashley is co-leader of the firm’s nationally ranked State Attorneys General practice, vice chair of the firm, and a partner in its Regulatory Investigations, Strategy + Enforcement (RISE) Practice Group. He helps his clients navigate the complexities involved with multistate attorneys general investigations and enforcement actions, federal agency actions, and accompanying litigation.
	Clay Friedman – Co-leader Clay co-leads the firm’s State Attorneys General practice and is nationally ranked by Chambers USA for AG Government Relations and in Best Lawyers for Advertising Law. He has dedicated his entire career to state attorney general and federal work, serving for nearly a decade in a senior role and more than 25+ years in private practice. Clay focuses his practice on helping industry-leading companies mitigate the risks associated with state and federal regulatory investigations and associated litigation.
	Chris Carlson Chris advises clients on regulatory, civil, and criminal investigations and litigation. With a background as an assistant attorney general, he provides practical guidance to clients with matters involving state attorneys general and federal regulatory agencies.
	Lauren Fincher Lauren has vast experience handling state attorneys general investigations, navigating complex regulatory compliance matters, and providing strategic counsel in enforcement actions across various industries. She helps clients manage high-stakes regulatory matters and guides them through complex legal landscapes.
	Stephen Piepgrass Stephen leads the firm’s Regulatory Investigations, Strategy + Enforcement (RISE) Practice Group, representing clients in single and multistate enforcement actions, including inquiries and investigations involving state attorneys general and other state and federal governmental enforcement bodies including the CFPB and FTC. He regularly represents clients in highly regulated sectors such as financial services, emerging technologies, health care, insurance, and education.
	Michael Yaghi Mike handles high-profile investigations led by state attorneys general, the FTC, and other federal and state regulatory bodies. He assists clients through these complex government inquiries, assisting them throughout the entire life cycle of investigations, from regulatory enforcement through formal litigation.
	Matthew J. Berns Drawing on his experience in senior leadership roles in the New Jersey Attorney General’s and Governor’s Offices and as a trial attorney for the U.S. Department of Justice, Matt provides an insider’s perspective when guiding clients through complex government investigations, litigation, and other actions.
	Jeff Johnson Jeff helps clients navigate complex regulatory and litigation challenges with local, state, and federal authorities. His clients benefit from his decade of broad litigation experience, understanding of emerging state and federal regulatory issues, and strong relationships with attorneys general across the U.S. In addition to handling cases from trial through state or federal appeals, Jeff serves as amicus counsel in advancing legal rules to support his clients’ vital interests.
	Jay Myers Jay assists clients in heavily regulated industries, including health care, energy, insurance, emerging industries, and data privacy. He provides both regulatory legal advice and government relations strategies. Jay’s past and current clients include Fortune 10 companies, startups, nonprofits, industry associations, and advocacy groups. Recognizing that state government matters are often complex and multifaceted, he utilizes regulatory guidance, government advocacy, or both in tandem to deliver tailored solutions for each client’s unique needs.
	Zoe Schloss Zoe represents clients in litigation and government investigations. As former deputy attorney general for the Delaware Department of Justice, she is an experienced litigator who understands the enforcement priorities that impact her clients. Zoe works with individuals and corporate entities in highly regulated industries, including financial services, health care, and energy.
	Jessica Birdsong Jessica is an associate in the firm’s Regulatory Investigations, Strategy + Enforcement Practice Group. She received her J.D. from the University of Richmond School of Law, magna cum laude, where she served as associate articles editor of the Journal of Law & Technology.
	Sydney Goldberg Sydney is an associate in the firm’s Regulatory Investigations, Strategy + Enforcement (RISE) Practice Group. She advises clients on regulatory compliance and state attorney general (AG) investigations in highly regulated industries, including health care and life sciences. She routinely helps clients navigate alcohol compliance and licensing issues, helping proactively manage regulatory risk.
	Troy Homesley Troy is an accomplished litigator who has represented and defended clients across a wide range of complex, high-stakes disputes at both the trial and appellate levels. He has represented technology companies, business executives, law firms, investment funds, high-ranking federal officials, international non-profits, and asylum seekers. Troy draws on his broad litigation experience to advise clients before litigation arises, while claims are pending or threatened, and leading up to and through trial and appeals.
	Namrata Kang Namrata (Nam) is an associate in the firm’s Regulatory Investigations, Strategy + Enforcement (RISE) Practice Group, based in the Washington, D.C. office. She routinely advises clients on a wide variety of state and federal regulatory matters, with a particular emphasis on state consumer protection laws relating to consumer financial services and marketing and advertising. Nam’s experience transcends multiple industries, including financial services, telecommunications, media, and sports betting.
	Michael Lafleur Michael is an associate in the firm’s Regulatory Investigations, Strategy, and Enforcement Practice Group. Based out of the firm’s Boston office, Mike has deep experience in litigation, investigations, and other regulatory matters involving state-level regulators and state attorneys general.
	William LaRosa Bill represents clients in complex regulatory investigations, state attorneys general matters, and enforcement proceedings. He draws on his experience as a former assistant U.S. attorney and as a private-sector litigator advising corporations in high-stakes litigation and regulatory investigations, including multistate AG investigations.
	Philip Nickerson Philip’s diverse practice includes representation of financial, tech, real estate, and energy companies in a range of government investigation and litigation matters. With experience obtaining favorable results for clients as a first and second-chair litigator in state and federal trial courts, arguing before federal courts of appeal, and representing clients in arbitration proceedings, he understands the importance of tailoring litigation strategy to align with clients’ goals.
	Lane Page Lane represents financial institutions and other clients in federal and state regulatory investigations and complex civil litigation. He is particularly focused on consumer protection and fair lending issues.
	Dascher Pasco Dascher provides strategic counsel and representation to clients navigating regulatory compliance, enforcement, and high-stakes litigation. She regularly represents clients in both single and multistate state attorney general (AG) investigations and enforcement actions, as well as before other state enforcement bodies and local government agencies.
	Kyara Rivera Rivera Kyara is an associate in the firm’s Regulatory Investigations, Strategy + Enforcement Practice Group. She received her J.D. from the University of Richmond School of Law, cum laude, where she served as publications and online editor of the Public Interest Law Review.
	Timothy Shyu Timothy advises clients on regulatory compliance and enforcement in highly regulated industries, including health care and life sciences, data privacy and cybersecurity, and emerging technology. He assists companies in navigating complex investigations and enforcement actions, helping them mitigate regulatory risk proactively.
	Trey Smith Trey focuses his practice on representing and advising regulated utilities before state public utility commissions. He routinely helps clients obtain certificates of public convenience and necessity for transmission infrastructure. In this role, Trey works with his clients’ subject-matter experts to manage administrative proceedings, including by preparing initial filings; responding to discovery requests; drafting rebuttal testimony; and litigating any disputed issues.
	Daniel Waltz Dan helps clients navigate all aspects highly regulated relationships between industry participants and federal, state and local governments. Whether engaging with regulators, negotiating transactions or representing clients in the courtroom, he delivers solutions that help his clients achieve their strategic goals.
	Stephanie Kozol Stephanie is Troutman Pepper Locke’s senior government relations manager in the state attorneys general department.