Arizona will receive about $612,000 from a multistate settlement with the genetic-testing company 23andMe, part of an $18 million payout to 42 states resolving claims from a 2023 data breach that exposed the genetic information of 6.9 million customers, according to the state attorney general's office and news reports.
The settlement, announced July 14, was reached with the trustee overseeing 23andMe's bankruptcy. The coalition's claims were allowed at $150 million, but because the bankruptcy estate's funds are finite and face many competing claims, $18 million is being paid out immediately and divided among the participating states.
The breach began in 2023, when attackers used a technique called credential stuffing, trying passwords stolen in other companies' breaches, to break into thousands of 23andMe accounts and, through them, harvest data on millions of customers. The company disclosed the intrusion in October 2023.
Exposed information included names, ancestry details and, in some cases, genetic markers; some of the data was later offered for sale online.
Beyond the money, the settlement requires the company's new custodian to maintain enhanced data-security standards, conduct risk assessments, create an independent data-security advisory board and preserve customers' right to delete their information. 23andMe filed for bankruptcy protection in March 2025.
