Alabama will receive $260,817 through a multistate settlement resolving bankruptcy claims against genetic testing company 23andMe over a 2023 data breach that exposed millions of customers’ personal and genetic information.
Attorney General Steve Marshall announced Thursday that Alabama and a coalition of 41 other states had reached an agreement with the bankruptcy trustee overseeing 23andMe’s Chapter 11 proceedings.
The settlement allows participating states to claim $150 million. However, only $18 million will be distributed among the states because of the company’s limited bankruptcy assets and competing claims.
The agreement resolves allegations related to a 2023 cyberattack that compromised data belonging to about 6.9 million 23andMe customers worldwide, including 69,950 in Alabama. The states alleged that 23andMe failed to use reasonable security measures to protect customers’ sensitive genetic and personal information from credential-stuffing attacks.
“Last fall, we advised consumers to delete their accounts with 23andMe due to lack of accountability discovered within the tech company,” Marshall said. “While this settlement is a giant step in the right direction to begin to hold 23andMe accountable, it does not justify their actions.”
The states alleged that 23andMe failed to protect against credential-stuffing attacks, monitor for suspicious activity, investigate unusual login patterns, address known security vulnerabilities and adequately test its security systems.
The settlement also establishes privacy and cybersecurity protections related to the company’s new ownership.
23andMe filed for bankruptcy in March 2025. TTAM Research Institute later purchased the company’s assets, including its consumer genetic data. Former 23andMe CEO and co-founder Anne Wojcicki formed the nonprofit institute.
As part of the bankruptcy proceedings, the new owner agreed to enhance data security, conduct comprehensive risk assessments, create an advisory board, comply with applicable state privacy laws and preserve consumers’ right to delete their genetic data.
The multistate settlement is separate from a $46.75 million class-action settlement approved in the bankruptcy case. That settlement will compensate eligible U.S. consumers who filed claims related to the data breach.
The settlement comes as Alabama lawmakers have increased their scrutiny of genetic privacy following the 23andMe breach and bankruptcy.
During the 2026 Legislative Session, Representative Ben Robbins, R-Sylacauga, introduced House Bill 265, which would have created criminal penalties for collecting, retaining, testing, disclosing or selling another person’s DNA or genetic information without express consent.
HB265 also would have made the unauthorized sale or transfer of a person’s DNA or genetic data to a third party a Class C felony and established penalties for unauthorized access to genetic information through computer systems.
The House Judiciary Committee approved the legislation, and the House placed it on its calendar. Lawmakers did not give the measure final approval before the session ended.
