42 States Reach $18M Settlement with 23andMe Over 2023 Data Breach
A coalition of 42 states, including Arizona, has finalized an $18 million settlement with biotech company 23andMe following a 2023 data breach that exposed the private information of millions of customers. The breach, which compromised sensitive genetic and personal data, prompted a multi-state investigation into the company’s security practices.
The settlement resolves allegations that 23andMe failed to implement adequate safeguards to protect user data, leading to unauthorized access. While details of the breach’s scope and the specific vulnerabilities exploited remain under review, the agreement requires the company to enhance its cybersecurity measures and improve transparency around future incidents.
The case underscores growing regulatory scrutiny over data privacy in the genetic testing industry, where personal and health-related information is increasingly targeted by cyber threats. The financial penalty and mandated reforms aim to hold 23andMe accountable while setting a precedent for similar cases.
23andMe cybersecurity rating report: https://www.rankiteo.com/company/23andme
"id": "23A1784075183",
"linkid": "23andme",
"type": "Breach",
"date": "12/2021",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Millions',
'industry': 'Genetic Testing',
'name': '23andMe',
'type': 'Biotech Company'}],
'data_breach': {'number_of_records_exposed': 'Millions',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': 'Genetic and personal data'},
'date_publicly_disclosed': '2023',
'description': 'A coalition of 42 states, including Arizona, has finalized an '
'$18 million settlement with biotech company 23andMe following '
'a 2023 data breach that exposed the private information of '
'millions of customers. The breach compromised sensitive '
'genetic and personal data, prompting a multi-state '
'investigation into the company’s security practices.',
'impact': {'data_compromised': 'Sensitive genetic and personal data',
'financial_loss': '$18,000,000',
'legal_liabilities': 'Multi-state investigation and settlement'},
'investigation_status': 'Resolved (settlement finalized)',
'lessons_learned': 'Growing regulatory scrutiny over data privacy in the '
'genetic testing industry; need for stronger safeguards to '
'protect user data.',
'post_incident_analysis': {'corrective_actions': 'Enhance cybersecurity '
'measures and improve '
'transparency around future '
'incidents',
'root_causes': 'Failure to implement adequate '
'safeguards to protect user data'},
'recommendations': 'Enhance cybersecurity measures and improve transparency '
'around future incidents.',
'references': [{'source': 'News Article'}],
'regulatory_compliance': {'fines_imposed': '$18,000,000',
'legal_actions': 'Settlement with 42 states'},
'response': {'remediation_measures': 'Enhance cybersecurity measures and '
'improve transparency around future '
'incidents'},
'title': '42 States Reach $18M Settlement with 23andMe Over 2023 Data Breach',
'type': 'Data Breach'}