DES MOINES, IOWA (July 14, 2026) — Attorney General Brenna Bird today joined a coalition of 42 attorneys general announcing a settlement with the bankruptcy trustee for 23andMe, resolving allegations stemming from a 2023 data breach that compromised the genetic data of 6.9 million customers worldwide.
Due to the finite amount of funds in the bankruptcy estate and numerous other claims, recovery of $150 million in allowed claims for states has been limited to $18 million. The $18 million settlement will be paid out of available bankruptcy funds immediately, and Iowa will receive $429,767. Earlier this year, the bankruptcy court approved a $46.75 million class-action settlement (see here) to provide relief to affected US consumers, including eligible Iowans, who submitted claims by February 17, 2026.
“Thousands of Iowans used 23andme to find out about their ancestry,” said AG Bird.
“What should have been an enlightening experience turned into a nightmare when their sensitive genetic data was breached because of 23andme’s severe lack of security and then their persistent lack of accountability. This settlement is part of making sure this kind of breach will not happen again to Iowans.”
In October 2023, direct-to-consumer genetic testing company 23andMe announced that it had discovered a data breach in which 6.9 million consumers were affected. This data breach exposed a wide range of data about 23andMe customers, including in some cases genetic ancestry information, and subsets of this data were subsequently published for sale on the dark web. 23andMe learned about the breach months after impacted personal information was publicly available, initially accepted no responsibility for the breach, and, at one point, blamed users for the breach.
In the immediate aftermath of the data breach, the Attorneys General formed a multistate investigation to investigate violations of consumer protection laws like Iowa’s Consumer Fraud Act and the Iowa Consumer Data Protection Act. The investigation found that 23andMe engaged in unreasonable data security practices, including, but not limited to:
- Failing to employ safeguards against credential stuffing attacks, including comparing passwords against blocklists of known breached passwords or requiring multifactor authentication;
- Failing to implement appropriate rate-limiting or intrusion-prevention;
- Failing to implement logging and monitoring or other tools likely to detect a data breach;
- Failing to appropriately investigate and/or address unusual login in patterns, including, for example, a massive spike in login attempts;
- Failing to remediate known vulnerabilities; and
- Failing to properly review and test design features.
In March 2025, 23andMe filed for bankruptcy protection, and states subsequently filed claims related to the data breach investigation. As part of the bankruptcy proceedings, the assets — notably 23andMe’s consumer data — were sold to TTAM Research Institute, a non-profit formed by 23andMe founder and former CEO Anne Wojcicki. The terms of the sale included many information and data-security requirements that likely would have been included in a settlement with 23andMe had it not filed for bankruptcy. Such terms included enhanced data-security requirements, appropriate risk-analysis, the addition of an Advisory Board, agreeing to be bound by comprehensive privacy laws without exception, and continuing to offer consumer deletion rights. These terms will make sure that TTAM Research Institute, now reregistered as 23andMe Research Institute, will be a safer custodian of genetic data moving forward.
Attorney General Brenna Bird joined the attorneys-general of Alabama, Alaska, Arizona, Arkansas, Colorado, Connecticut, Delaware, the District of Columbia, Florida, Georgia, Idaho, Illinois, Indiana, Kansas, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, New Hampshire, New Jersey, New Mexico, New York, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, South Carolina, South Dakota, Tennessee, Texas, Utah, Vermont, Virginia, Washington, West Virginia, and Wisconsin in today’s settlement.
Read the official filing here.
