LOUISVILLE, Ky. (WDRB) — Kentucky's attorney general announced a settlement Monday in a 23andMe data breach case.
Attorney General Russell Coleman said the state would be compensated more than $259,000 in the 2023 data breach.
Coleman and 41 other attorneys general launched an investigation after the genetic testing company announced a data breach affecting 6.9 million people, including more than 69,000 people in Kentucky.
That investigation, Coleman's office said, found 23andMe "failed to employ safeguards like multifactor authentication to investigate unusual login patters including a massive spike in login attempts, and to properly review and test design features."
Affected data included genetic ancestry information, which officials said was published for sale on the dark web. 23andMe collects and analyzes people's genetic code and uses DNA samples for a variety of purposes, helping people trace their ancestry and detect personal health risks.
"Kentuckians deserve to have their most sensitive personal data kept safe," Coleman said in a news release. "When companies like 23andMe fail to maintain proper security practices, our Office will take action."
States began filing claims in the data breach as the company filed for bankruptcy protection in March 2025. That April, Coleman issued a consumer alert to Kentuckians to protect their genetic data by deleting it on 23andMe.Â
As part of the bankruptcy proceedings, assets, including 23andMe's consumer data, were sold to TTAM Research Institute. Terms of the sale included data security requirements.
The states' claims total $150 million. Coleman's office said 23andMe "does not have enough assets to satisfy all creditors," and that a payment of $18 million would be made "immediately." Of that, Kentucky will get $259,375 that will go into the state's general fund for use by the General Assembly.
Copyright 2026 WDRB Media. All Rights Reserved.
