$461,688 of $18 million Multi-state Settlement in 23andMe Bankruptcy to Come to Utah

Salt Lake City, Utah – The Utah Attorney General’s Office and the Utah Department of Commerce’s Division of Consumer Protection, alongside a coalition of more than forty states, secured an $18 million settlement arising from the bankruptcy proceedings of 23andMe. 

23andMe, once a leader in consumer genetic analysis and ancestry services, allowed users to submit samples for detailed genetic analysis. In 2023, the company suffered a significant data breach affecting approximately 6.9 million users. The compromised information included sensitive details regarding users’ identities, ancestry, and genetic profiles.  
 
Utah will receive $461,688 as its share of the $18 million settlement. Utahns affected by the breach will be compensated separately through a $46.75 million class-action settlement in the bankruptcy, which provides relief to U.S. consumers who submitted claims by February 17, 2026.  

“This settlement sends a clear message: companies that collect sensitive genetic and personal data must uphold the highest standards of privacy and security,” said Utah Attorney General Derek Brown. “We will continue to hold organizations accountable and protect our residents from the misuse of their most personal information.” 

Following the breach, malicious actors posted lists for sale on the dark web, reportedly targeting users of Ashkenazi Jewish and Chinese descent. This incident prompted a bipartisan investigation into whether 23andMe violated state data privacy, consumer protection, and genetic information privacy laws. 

In early 2025, 23andMe declared bankruptcy. During the proceedings, coalition states successfully secured restrictions on the future use of genetic information previously collected by the company, ensuring enhanced protections for individuals in the future. 

“Holding 23andMe accountable is critical to ensure that companies know they have a responsibility to the consumer, to protect the personal information they receive when people use their services,” said Margaret Busse, Commissioner of the Utah Department of Commerce. “23andMe failed its customers—it did not do enough to protect them, and their most sensitive, private information. This breach of trust is unacceptable.” 

The coalition’s efforts culminated in a settlement with the bankruptcy trust of $18 million. These funds will be used to further protect consumers and address the ramifications of the data breach. 

For more information about the settlement and available resources for affected individuals, please contact the Utah Attorney General’s Office.