By admin 
PHOENIX (AZFamily) — A 42-state coalition, which includes Arizona, has settled with a biotechnology company over a data breach that exposed millions of customers’ genetic information nationwide.
Read more Man fleeing ICE officers in Florida is struck and killed by tractor trailer, police say
Arizona Attorney General Kris Mayes announced on Tuesday that a settlement was reached with 23andMe, stemming from a 2023 data breach that compromised the genetic information of nearly 7 million customers.
In Oct. 2023, the genetic testing company announced it had discovered a data breach affecting millions, including 143,000 users in Arizona. The breach exposed users’ genetic ancestry information, which hackers put up for sale on the dark web.
Officials say the company initially denied the breach, then “blamed consumers” for how their accounts were set up and how their passwords were used.
The investigation found the genetic testing company had failed to establish basic security measures, leaving millions vulnerable. Officials say 23andMe did not protect against common password attacks, failed to monitor suspicious login activity, ignored unusual spikes in login attempts and did not fix known security issues.
“23andMe recklessly exposed Arizonans’ sensitive genetic data to hackers, allowing it to end up on the dark web,” Mayes said in a statement. “This settlement, combined with private class‑action settlements, brings some measure of accountability — but companies that hold such sensitive information must do a better job protecting the data of consumers. We will continue working to hold companies accountable when they fail Arizona consumers.”
After 23andMe filed for bankruptcy in March 2025, its customer data was sold to a nonprofit run by its founder and former CEO, Anne Wojcicki.
Read more Trial set to begin for man accused of shooting Phoenix officer 8 times
Because of limited bankruptcy funds, the settlement is capped at $18 million, with Arizona receiving about $612,000. The company also agreed to a $46.75 million class-action settlement to compensate affected customers who filed claims by February 2026.
As part of the settlement, 23andMe must strengthen data security, follow strict privacy laws and continue to allow customers to delete their data.
Arizona is one of the few states with a genetic data law, called the Arizona Genetic Information Privacy Act, which regulates genetic testing companies like 23andMe.
See a spelling or grammatical error in our story? Please click here to report it.
Do you have a photo or video of a breaking news story? Send it to us here with a brief description.
Read more Scattered thunderstorms are expected this afternoon