Kentucky AG secures settlement in 23andMe genetic data breach case
FRANKFORT, Ky. (ABC 36 NEWS NOW) – Kentucky Attorney General Russell Coleman has secured compensation for Kentuckians whose personal information was compromised in a 2023 data breach at genetic testing company 23andMe.
Coleman joined 41 other attorneys general to resolve allegations stemming from the breach, which reportedly compromised the genetic data of 6.9 million customers worldwide, including 69,188 in Kentucky.
The states approved claims totaling $150 million, but the “bankrupt company does not have enough assets to satisfy all creditors,” a press release from the office of AG Coleman read. An $18 million payment will be made immediately, of which Kentucky will receive $259,375.
“Kentuckians deserve to have their most sensitive personal data kept safe. When companies like 23andMe fail to maintain proper security practices, our Office will take action,” Coleman said.
In October 2023, 23andMe announced the breach had affected 6.9 million customers. The breach exposed a wide range of data, including genetic ancestry information. Subsets of that data were subsequently published for sale on the dark web.
An investigation by attorneys general found 23andMe failed to employ safeguards like multifactor authentication, failed to investigate unusual login patterns including a massive spike in login attempts, and failed to properly review and test design features, according to Coleman.
23andMe filed for bankruptcy protection in March 2025. States subsequently filed claims related to the data breach investigation. As part of the bankruptcy proceedings, 23andMe’s consumer data was sold to TTAM Research Institute with terms of sale including data security requirements. TTAM Research Institute has since been reregistered as 23andMe Research Institute.
Coleman issued a consumer alert encouraging Kentuckians to delete their 23andMe data and provided a step-by-step guide to protecting personal information.
