(WKYT) – Kentucky is part of a multi-state, $150 million settlement stemming from a 2023 data breach that compromised genetic data of 6.9 million 23andMe customers worldwide, according to the Kentucky Attorney General’s Office.
“Kentuckians deserve to have their most sensitive personal data kept safe. When companies like 23andMe fail to maintain proper security practices, our Office will take action,” said Attorney General Russell Coleman.
The breach included 69,188 Kentuckians and exposed a wide range of data about customers, including genetic ancestry information that was sold on the dark web.
An investigation found 23andMe failed to employ safeguards to investigate unusual login patterns and review and test design features.
Claims were filed against 23andMe in 2025 when the company filed for bankruptcy. A sale to what is now known as the 23andMe Research Institute included data security requirements to protect genetic data better going forward.
Because the company is in bankruptcy, it does not have the assets to pay the $150 million in claims, but $18 million will be paid immediately.
Kentucky will receive $259,375 of that payment.