California settles 23andMe credential-stuffing breach case for $6 million, dropping its appeal over the TTAM sale
California has settled with 23andMe for $6 million over the 2023 credential-stuffing breach. The breach exposed personal and genetic data of about 6.9 million people, including 855,000 California residents. The settlement follows a July 2026 $18 million settlement with a coalition of 42 state attorneys general, which California did not join. California also agreed to drop its appeal of a bankruptcy court ruling that barred it from suing TTAM Research Institute, the non-profit controlled by co-founder Anne Wojcicki that bought 23andMe for $305 million. The sale and transfer of customer data to TTAM will go ahead, but customers can request deletion of their personal and genetic data.
Technical Details
- The attack was credential stuffing that exploited weak and reused customer passwords.
- The states argued 23andMe should have known customer accounts were at risk and should have implemented measures to detect and block such attacks.
- Exposed data included personal and genetic information.
- California had tried to block the sale under the California Genetic Information Privacy Act, arguing customers had not consented to the transfer of their data. The attempt failed.
- Related payouts: a $46.75 million class action settlement with customers, approved in July 2026, brings combined settlements to about $24 million with regulators plus the class payout.
Remediation
- California AG Rob Bonta reminded Californians that 23andMe customers can delete their genetic data regardless of who owns it.
- The case shows regulators expect detection and blocking controls for credential-based attacks on customer accounts, such as MFA, rate limiting and anomaly detection.
Linha do tempo
-
California settles 23andMe credential-stuffing breach case for $6 million, dropping its appeal over the TTAM sale
ler a análise desta fonte ocultar
California has settled with 23andMe for $6 million over the 2023 credential-stuffing breach. The breach exposed personal and genetic data of about 6.9 million people, including 855,000 California residents. The settlement follows a July 2026 $18 million settlement with a coalition of 42 state attorneys general, which California did not join. California also agreed to drop its appeal of a bankruptcy court ruling that barred it from suing TTAM Research Institute, the non-profit controlled by co-founder Anne Wojcicki that bought 23andMe for $305 million. The sale and transfer of customer data to TTAM will go ahead, but customers can request deletion of their personal and genetic data.
Technical Details
- The attack was credential stuffing that exploited weak and reused customer passwords.
- The states argued 23andMe should have known customer accounts were at risk and should have implemented measures to detect and block such attacks.
- Exposed data included personal and genetic information.
- California had tried to block the sale under the California Genetic Information Privacy Act, arguing customers had not consented to the transfer of their data. The attempt failed.
- Related payouts: a $46.75 million class action settlement with customers, approved in July 2026, brings combined settlements to about $24 million with regulators plus the class payout.
Remediation
- California AG Rob Bonta reminded Californians that 23andMe customers can delete their genetic data regardless of who owns it.
- The case shows regulators expect detection and blocking controls for credential-based attacks on customer accounts, such as MFA, rate limiting and anomaly detection.