The legal fallout from the massive 23andMe data breach continues, with a new multistate settlement providing millions of dollars to states following the genetic testing company’s bankruptcy.

A coalition of 42 state attorneys general reached a settlement with the 23andMe bankruptcy trustee over allegations arising from the company’s 2023 cybersecurity incident, which affected approximately 6.9 million customers worldwide.

The settlement provides the states with $150 million in allowed bankruptcy claims. Because 23andMe’s bankruptcy estate has limited funds and faces numerous competing claims, however, the states’ actual recovery is limited to $18 million from currently available bankruptcy funds.

For Pennsylvania consumers, the development is another reminder of the extraordinary sensitivity of genetic information—and of what can happen when a company possessing enormous quantities of personal information enters bankruptcy.

What Happened in the 23andMe Data Breach?

23andMe disclosed a cybersecurity incident in October 2023.

The breach ultimately affected millions of consumers and involved information that, depending upon the individual, could include names, dates of birth, genetic information, ancestry information, predicted genetic relationships, family-tree information, profile information and geographic location. The consumer settlement administrator states that approximately 6.4 million U.S. residents were affected.

Genetic information presents privacy concerns that differ significantly from those associated with an ordinary data breach.

You can change a password.

You can cancel a compromised credit card.

You cannot change your DNA.

Genetic information may also reveal information not merely about one person but potentially about biological relatives.

That makes the security of genetic databases an especially significant consumer privacy issue.

States Reach an $18 Million Recovery

On July 14, 2026, a coalition of 42 attorneys general announced a settlement with the bankruptcy trustee resolving state claims associated with the breach.

The agreement provides $150 million in allowed claims for participating states. But because of the limited assets available in bankruptcy and the existence of numerous competing claims, the actual recovery is currently limited to $18 million.

Pennsylvania is expected to receive approximately $491,902 from that recovery.

The state settlement should not be confused with the separate class-action settlement established for individual consumers.

There Is Also a Separate Consumer Settlement

Consumers may have heard several different dollar amounts associated with the 23andMe litigation.

That is because there are different proceedings and settlements.

The official consumer settlement website states that the Bankruptcy Court granted final approval of the class-action settlement on January 30, 2026. On July 7, 2026, the court approved a final settlement amount of $46.75 million.

Eligible settlement benefits include, depending upon the claim, payments for extraordinary losses, health-information claims, statutory cash claims and genetic/privacy monitoring.

However, there is an important problem for consumers who are only learning about the settlement now.

The Consumer Claim Deadline Has Passed

The deadline to submit a claim in the consumer settlement was February 17, 2026.

That deadline has now passed.

The official settlement website also listed June 12, 2026 as the deadline for submitting a deficiency cure form for certain claims.

Consumers who previously submitted valid claims should continue monitoring communications from the settlement administrator.

The settlement website currently states that class-member payments are expected to be distributed in September 2026.

Consumers should be cautious about websites, emails or social-media posts suggesting that they can simply file a new claim today.

The official deadline has passed.

Why Did Bankruptcy Complicate the 23andMe Case?

23andMe’s financial problems created an unusual issue because one of the company’s most valuable assets was also one of its most sensitive:

its customer data.

The company filed for Chapter 11 bankruptcy protection in March 2025.

Bankruptcy normally involves determining what assets a debtor possesses and how those assets can be sold or otherwise used to satisfy creditors.

But a database containing genetic information raises privacy issues far beyond those associated with selling office equipment, inventory or ordinary intellectual property.

Consumers provided DNA samples and genetic information for particular purposes. Many understandably became concerned about what would happen to that information if 23andMe itself ceased to exist in its previous form.

A Consumer Privacy Ombudsman Was Appointed

The bankruptcy proceedings included the appointment of a Consumer Privacy Ombudsman to examine privacy issues surrounding the handling and proposed transfer of customer information.

That oversight was particularly significant because the bankruptcy involved extraordinarily sensitive genetic and personal information.

Ultimately, 23andMe’s assets were sold to the TTAM Research Institute, a nonprofit established by 23andMe co-founder and former CEO Anne Wojcicki.

The multistate settlement announcement says the transaction includes substantial information-security and privacy requirements.

Among other things, the new custodian agreed to enhanced security requirements, appropriate risk analysis, an advisory board, compliance with applicable state comprehensive privacy laws and continued consumer deletion rights.

These safeguards matter because a bankruptcy does not make consumers’ privacy interests disappear.

Can Consumers Still File a 23andMe Settlement Claim?

For the existing consumer class-action settlement, the published answer is generally no for consumers who never submitted a timely claim.

The February 17, 2026 claim deadline has passed.

Consumers who already filed claims should instead monitor the official settlement process for payment information and requests from the administrator.

Be particularly cautious about unsolicited emails or text messages promising to recover a 23andMe settlement payment in exchange for personal information or an upfront fee.

A high-profile settlement creates an obvious opportunity for scammers.

What Should 23andMe Customers Do Now?

Even if you missed the settlement deadline, privacy remains important.

Consumers who maintain accounts associated with genetic-testing services should use unique passwords and available multifactor authentication.

They should also carefully evaluate the privacy controls available through the service.

Consumers concerned about continued retention of their genetic information should investigate what deletion options are currently available to them and understand exactly what those options do and do not delete.

Do not assume deleting an app from your telephone deletes information previously supplied to a company.

Account deletion, sample destruction and deletion of information used or retained for research purposes may involve different procedures.

Genetic Information Deserves Special Protection

The 23andMe litigation illustrates an emerging challenge in consumer privacy law.

Companies increasingly possess information that consumers cannot realistically replace.

Biometric information, facial recognition data and genetic information are fundamentally different from an ordinary account password.

When companies collect these types of information, consumers are placing enormous trust in their security and privacy practices.

And when a company enters bankruptcy, questions arise not only about who gets its money and property, but also about who becomes the next custodian of its customers’ information.

Pennsylvania Consumers Should Continue Watching the Case

For Pennsylvania residents, the newest multistate settlement represents another measure of accountability arising from the 23andMe breach.

But consumers should understand that Pennsylvania’s recovery is not a new $491,902 fund from which individual Pennsylvania residents can presently submit claims.

It is part of the multistate government’s bankruptcy recovery.

The separate consumer class-action process has its own settlement fund and deadlines.

The consumer claim deadline has already passed.

Consumers who filed timely claims should continue watching for settlement communications and payment information.

Questions About a Data Breach?

Data breaches increasingly expose information that consumers cannot easily protect or replace.

If your personal information has been compromised in a data breach and you have experienced identity theft, fraudulent accounts, financial losses or other harm, you may have legal rights depending upon the circumstances.

Ginsburg Law Group, P.C. represents consumers in matters involving consumer protection and privacy rights.

Call 855-978-6564

Visit www.ginsburglawgroup.com

Attorney Advertising. This article is for informational purposes only and does not constitute legal advice. Settlement eligibility, deadlines and benefits are controlled by court orders and official settlement documents. Past results do not guarantee a similar outcome.