Michigan Attorney General Dana Nessel announced a major multistate settlement with the bankruptcy trustee for 23andMe, alongside 41 other attorneys general. The agreement resolves claims surrounding a massive cyberattack in 2023 that compromised the highly sensitive genetic data of 6.9 million people around the globe.
The state coalition secured $150 million in allowed claims. However, because 23andMe is working through bankruptcy and has a finite amount of money to pay off its debts, the states will actually share an immediate $18 million payout.
Out of that pool, Michigan is set to receive $436,605. This state-level agreement is separate from a $46.75 million class-action settlement set aside for individual U.S. consumers who filed claims before a February deadline.
The trouble started in October 2023 when the direct-to-consumer DNA testing giant revealed a security failure. Hackers accessed customer records, including genetic ancestry details in some cases, and later put segments of that information up for sale on the dark web. The breach impacted 162,865 people in Michigan.
“Protecting the personal information of Michigan residents has been one of my top priorities during my time in office, and we will not stand by when companies fail to safeguard consumer data,” Nessel said. “I am proud to have worked with this coalition to secure this settlement. We remain committed to defending the privacy of Michiganders and ensuring that corporations that fail their customers are held accountable.”
State investigators found that 23andMe actually learned about the hack months after the data leaked online. At first, the company denied a breach occurred. Once it was confirmed, the company blamed its own users for how they set up their accounts and managed their passwords. Investigators noted that 23andMe initially accepted no responsibility, a stance they found especially problematic given that 23andMe’s partner company, MyHeritage, had suffered a similar breach years prior that exposed thousands of shared login credentials.
The multistate investigation ultimately determined the company ignored basic security practices. Investigators found 23andMe failed to require multifactor authentication, didn’t check passwords against lists of known breached passwords, and completely missed a massive spike in unusual login attempts. The company was also faulted for failing to implement proper monitoring tools or fix known vulnerabilities.
The fallout eventually pushed 23andMe to file for bankruptcy in March 2025. As part of that process, the company’s assets and consumer data were sold to the TTAM Research Institute, a newly formed non-profit run by 23andMe founder Anne Wojcicki. To finalize the sale, the new organization—now renamed the 23andMe Research Institute—had to agree to strict security upgrades that the states would have demanded in a normal settlement. The company is now required to run proper risk analysis, create an advisory board, follow state privacy laws, and allow consumers to delete their data.
The breach has also sparked a push for tighter laws in Michigan. Senate Bill 359, sponsored by state Senator Rosemary Bayer, is currently waiting for a vote. The legislation, known as the Michigan Personal Data Privacy Act, would align Michigan with 23 other states that already have strict data privacy laws and give the Attorney General more power to sue companies over data violations.
“Michigan consumers deserve the protections necessary to keep their personal information safe,” Nessel said. “I urge the Legislature to pass this much-needed legislation to provide meaningful, long-overdue privacy rights to Michiganders while giving my office the ability to pursue companies that compromise our residents’ data.”
READ: Yard-Side Tragedy Sparks Murder Charge: Central Florida Man Tied To Elderly Neighbor’s Death
Please make a small donation to the Tampa Free Press to help sustain independent journalism. Your contribution enables us to continue delivering high-quality, local, and national news coverage.
Sign up: Subscribe to our free newsletter for a curated selection of top stories delivered straight to your inbox.
