Queen Creek, Arizona — Attorney General Kris Mayes joined a coalition of 42 attorneys general in a settlement with the bankruptcy trustee for 23andMe, resolving claims from a 2023 data breach that exposed the genetic information of customers nationwide.
The settlement makes $18 million available from the bankruptcy estate, with Arizona receiving $612,269 in civil penalties. A separate $46.75 million class-action settlement is also available to affected U.S. consumers who filed claims by February 17, 2026. The multistate investigation found 23andMe engaged in unreasonable data-security practices before and after the breach.
In October 2023, 23andMe said it had discovered a breach affecting 6.9 million consumers, including more than 143,000 in Arizona. Subsets of the data were later published for sale on the dark web. Arizona is among the few states with a dedicated genetic-information privacy law covering direct-to-consumer testing companies.
"23andMe recklessly exposed Arizonans' sensitive genetic data to hackers, allowing it to end up on the dark web," Mayes said, adding that companies holding such information must do a better job protecting consumers.
The Pinal and Maricopa County town is home to residents whose genetic information was among the more than 143,000 Arizona accounts exposed in the 2023 breach.
