Minnesota Included in Major 23andMe Data-Breach Settlement

Minnesota will receive more than 514-thousand dollars as part of a multistate settlement involving genetic-testing company 23andMe.

Attorney General Keith Ellison joined attorneys general from more than 40 states in resolving claims connected to a major 2023 data breach. The cyberattack exposed personal and genetic information belonging to approximately 6.9 million customers worldwide, including more than 92-thousand Minnesotans.

Investigators alleged that 23andMe failed to maintain adequate security protections, did not respond quickly enough to warning signs and initially placed much of the blame on customers who had reused passwords.

Hackers reportedly gained access to about 14-thousand individual accounts by using login information stolen during previous data breaches. Because those accounts were connected to 23andMe’s DNA Relatives feature, the attackers were then able to access information associated with millions of additional users.

The compromised information included names, birth years, locations, ancestry reports, genetic profiles and information about relatives. Some of the stolen data was later offered for sale online.

The states were granted 150-million dollars in bankruptcy claims against the company. However, because 23andMe filed for bankruptcy and has limited funds available, the states will immediately recover a total of 18-million dollars. Minnesota’s portion is 514-thousand-871 dollars.

A separate 46.75-million-dollar class-action settlement has also been approved for affected customers who submitted claims before the February deadline.

Ellison says genetic information is among the most personal and irreplaceable information a company can collect and must be protected with the highest level of security.