Connecticut Attorney General Leads $18 Million Multistate Settlement with 23andMe Over 2023 Data Breach

Connecticut Attorney General John M. Formella announced an $18 million multistate settlement with direct‑to‑consumer genetics company 23andMe, resolving claims that a 2023 cyber‑attack exposed the personal and genetic information of millions of customers. The agreement, which includes 42 states and the District of Columbia, marks the largest coordinated response to a consumer‑data breach in the genetic‑testing sector.

Core developments

The settlement was unveiled in a joint press release issued by the Connecticut Attorney General’s Office and the Rochester Post. Formella confirmed that 23andMe will pay $18 million to fund consumer restitution, civil penalties, and a statewide consumer‑protection fund that will be administered by the participating attorneys general. The funds are earmarked for affected individuals to obtain credit‑monitoring services, identity‑theft protection, and other remedial measures.

According to the Hunton Andrews Kurth LLP briefing, the breach was first discovered in February 2023 when 23andMe detected unauthorized access to a cloud‑based server that stored user‑submitted DNA data, health questionnaires, and contact information. The company reported that the intrusion was limited to a subset of its data infrastructure and that no evidence indicated the stolen data had been sold or otherwise misused, but the exposure of genetic information raised unique privacy concerns.

State officials from Connecticut, Utah, Kansas, and 39 other jurisdictions signed onto the settlement, as reported by KPCW and KCTV. Utah’s participation was highlighted in a separate local report, noting that the state’s attorney general joined the multistate effort to ensure residents receive the same protections and restitution as those in other states.

In addition to the monetary component, the settlement requires 23andMe to implement a comprehensive security‑enhancement plan overseen by an independent third‑party auditor. The plan includes regular penetration testing, encryption upgrades for data at rest and in transit, and mandatory employee training on data‑privacy best practices.

Why it matters

Genetic data is inherently personal, linking individuals to health predispositions, ancestry, and familial relationships. Unlike passwords or credit‑card numbers, genetic information cannot be changed once compromised, making its protection a public‑policy priority. The 2023 breach undersced the vulnerability of consumer‑health platforms that aggregate large volumes of DNA data, prompting legislators and regulators to scrutinize the sector’s security standards.

The settlement sets a precedent for coordinated, multistate action against data‑breach harms in the biotech industry. By pooling resources, the participating attorneys general amplified their negotiating leverage, securing a larger restitution pool than any single state could have obtained alone. The agreement also signals to the broader market that regulators will hold companies accountable for lapses that expose immutable biological data.

From a consumer‑trust perspective, the settlement may help restore confidence in direct‑to‑consumer genetic testing. 23andMe, which has marketed its service as a gateway to personalized health insights, now faces heightened expectations for transparency and cybersecurity. The mandated third‑party audit could become a benchmark for future compliance across the industry.

Differing viewpoints and reactions

Formella emphasized that the settlement “protects the privacy and security of Connecticut residents and sets a clear standard for companies handling sensitive genetic information.” The statement, as reported by the Rochester Post, framed the agreement as a victory for consumer rights and a deterrent against future negligence.

Utah’s attorney general, while not quoted directly, expressed support for the multistate effort in a local news release, noting that Utah residents would benefit from the same restitution mechanisms as those in other states. The Cache Valley Daily highlighted Utah’s involvement as part of a broader strategy to ensure uniform consumer protection across state lines.

Industry observers, referenced indirectly through the Hunton Andrews Kurth LLP analysis, cautioned that the settlement does not address potential downstream uses of the exposed data, such as research collaborations or law‑enforcement requests. Some privacy advocates argue that the $18 million figure, while significant, may not fully compensate for the long‑term risks associated with genetic data exposure.

23andMe’s public statements were not included in the source material, leaving the company’s perspective on the settlement unreported in this coverage.

What’s next

The settlement will be administered by a consortium of the participating attorneys general, who will develop eligibility criteria for consumers to apply for restitution. 23andMe is expected to begin disbursing funds within the next 90 days, pending final approval of the remediation plan by the court.

Regulatory scrutiny of direct‑to‑consumer genetic testing is likely to intensify. The Federal Trade Commission has signaled interest in updating its privacy guidelines to specifically address biometric and genetic data, and lawmakers in several states are drafting bills that would impose stricter data‑security standards on companies handling such information.

For consumers, the settlement underscores the importance of monitoring credit reports and taking advantage of the offered identity‑theft protection services. As the industry expands, experts advise users to weigh the benefits of genetic testing against the potential privacy trade‑offs, especially in light of the evolving legal landscape.