MONTPELIER, Vt. (WCAX) – Vermont, New Hampshire, and New York are among 42 states joining in an $18 million settlement over a 2023 data breach by the genetic testing company 23andMe.
The data breach affected 6.9 million consumers, including nearly 14,000 Vermonters, according to the Vermont Attorney General’s Office.
The data, some of which included genetic ancestry information, was later published for sale on the dark web. The company initially denied culpability, according to the AG, but an investigation later found that it engaged in unreasonable data security practices.
As part of a bankruptcy settlement, Vermont is slated to get $154,000; New York will receive $705,000; and New Hampshire will get $187,490.
Vermont Attorney General Charity Clark says the case prompted her to push for passage of the state’s new Genetic Data Information Privacy Act approved by the Legislature this year.
“Our genetic data, like our DNA, is incredibly personal and forever unchangeable — it belongs to us,” Clark said in a statement. “Companies that collect this data must do so securely and responsibly. This settlement shows that not even bankruptcy will stop my office from pursuing companies that fail to protect Vermonters’ most sensitive information.”
“Protecting the sensitive personal data of New Hampshire consumers is critical. Working together, we were able to obtain accountability for the 23andMe data breach even after the bankruptcy case was filed,” New Hampshire Attorney General Formella said in a statement. “Just as important, we were able to secure protections for New Hampshire consumers who provided their personal data to 23andMe and ensure that TTAM Research Institute complies with these protections as the new data custodian.”
23andMe separately agreed to a $46.75 million class-action settlement for affected consumers, who were notified earlier this year.
Copyright 2026 WCAX. All rights reserved.