Vermont, New Hampshire, and New York residents harmed by the 2023 23andMe data breach are eligible to receive direct compensation from an $18 million multistate settlement announced in July 2026. Vermont will receive $154,000, New Hampshire $187,490, and New York $705,000 to be distributed among affected consumers in their states.
The settlement represents one of the largest data breach payouts in recent years and directly addresses the unauthorized exposure of genetic ancestry information and customer data that compromised approximately 6.9 million consumers nationwide, with nearly 14,000 Vermonters alone affected by the breach. The settlement comes after 23andMe filed for bankruptcy protection in March 2025, a move that triggered significant legal and regulatory scrutiny from attorneys general in all 50 states. The compensation is part of both the multistate settlement with state attorneys general and a separate $46.75 million settlement for consumers affected by the breach who submitted claims through the bankruptcy process by the February 17, 2026 deadline.
Table of Contents
- What Happened in the 23andMe Data Breach and Who Was Affected?
- State-by-State Settlement Compensation Amounts and Distribution
- The Bankruptcy Settlement and the Data Transfer to TTAM Research
- How to File a Claim for Settlement Compensation
- Important Limitations and What the Settlement Does Not Cover
- New Data Security Requirements and Long-Term Protections
- Key Dates and Deadlines for Vermont, New Hampshire, and New York Residents
What Happened in the 23andMe Data Breach and Who Was Affected?
In 2023, 23andMe experienced a significant data breach that exposed the genetic ancestry information and personal data of millions of consumers. The breach was particularly alarming because the stolen information included not just email addresses and passwords, but sensitive genetic ancestry data that consumers had voluntarily submitted to the company for genealogy services. For comparison, while data breaches affecting millions of records happen with unfortunate regularity in the financial and retail sectors, breaches involving genetic information carry unique risks because DNA data cannot be changed or reset like a password—once exposed, it remains a permanent vulnerability for the individual.
Nearly 14,000 Vermont residents were directly impacted by the breach, making it one of the larger state-level impacts reported. The 6.9 million total consumers affected makes this breach one of the most extensive genetic data exposures ever disclosed publicly. Many affected consumers reported feeling a deep violation of privacy, particularly because they had submitted their most intimate biological information to a company that ultimately failed to protect it adequately.
State-by-State Settlement Compensation Amounts and Distribution
The multistate settlement allocates compensation based on each state’s population of affected users and the severity of the breach impact within each state. Vermont’s $154,000 allocation works out to approximately $11 per affected resident based on the nearly 14,000 Vermonters impacted. New Hampshire’s $187,490 and New York’s $705,000 reflect similar per-capita distributions adjusted for the number of residents affected in each state. New York received the largest share among these three states because it had the most affected residents—a direct consequence of the state’s larger population and the fact that 23andMe’s customer base is distributed across all regions of the country.
A significant limitation of this settlement is that not all affected residents will receive equal compensation. Compensation amounts are typically distributed through a claims process where residents must file to receive their share, and the final amount paid to each individual depends on how many residents ultimately file valid claims in their state. This means that the per-person payout could range from a few dollars to several hundred dollars depending on participation rates. For example, if only half of affected Vermont residents file claims, the remaining $154,000 would be split among fewer people, potentially doubling or tripling individual payments—but if most file claims, payments will be smaller than initial estimates suggested.
The Bankruptcy Settlement and the Data Transfer to TTAM Research
When 23andMe filed for bankruptcy in March 2025, the company entered into a $46.75 million settlement with consumers who submitted claims through the bankruptcy process. This created a dual-settlement structure: the $18 million multistate settlement handled by state attorneys general and a separate bankruptcy settlement for individual claimants. The bankruptcy settlement was only available to consumers who submitted claims by February 17, 2026—a deadline that has now passed. One of the most controversial aspects of the settlement involves what happened to the genetic data itself.
23andMe sold customer data to TTAM Research, a non-profit organization formed by 23andMe’s founder and former CEO Anne Wojcicki. This data transfer occurred after the breach and as part of 23andMe’s restructuring following bankruptcy. The transfer raised significant concerns among consumer advocates and state attorneys general about whether a company could offload its most valuable asset—consumer genetic data—to a related entity to minimize its own liability. However, as part of the settlement, TTAM Research agreed to implement appropriate risk analysis, establish an Advisory Board focused on data security, and maintain the original consumers’ right to delete their information from the database.
How to File a Claim for Settlement Compensation
Affected residents in Vermont, New Hampshire, and New York can file claims through the official 23andMe Data Settlement website at www.23andmedatasettlement.com. The website contains state-specific information and claim forms for residents seeking compensation from the multistate settlement. The process typically requires submitting proof of residency in the affected state and documentation showing that your account was impacted by the breach—though the settlement administrator will likely use 23andMe’s breach notification records to verify claims. A key tradeoff to understand is timing versus payout amount.
If you file a claim relatively quickly, you’ll receive your compensation sooner, but if participation is low, you might receive more money per claim. If you delay filing, more claimants may have filed, which could reduce the individual payout, though payments might arrive later when the claims process is complete. The claims process can take several months from submission to payment, particularly if the settlement administrator must verify individual claims. For those who miss filing through this multistate settlement, it’s important to note that the bankruptcy settlement deadline of February 17, 2026 has already passed, so the multistate settlement is now the primary avenue for compensation.
Important Limitations and What the Settlement Does Not Cover
While the settlement provides meaningful compensation, it’s important to understand what it does not address. The settlement is a monetary payout only—it does not provide free credit monitoring, identity theft protection, or other services that some breach settlements include. This means affected residents are responsible for monitoring their own credit and considering whether to purchase identity theft protection services independently. The settlement money is meant to compensate for the harm of the breach itself, not to cover any fraud or misuse of data that may have occurred after the breach.
Another critical limitation is that residents must affirmatively file a claim to receive compensation—compensation is not automatic. Some residents may not be aware of the settlement opportunity, and others may miss filing deadlines established by the settlement administrator. Additionally, the settlement requires that claimants prove they were actually affected by the breach, which typically means proving residency in the affected state and that their account was part of 23andMe’s customer database in 2023. Residents who cannot locate their original breach notification letter or account records may face challenges in proving their eligibility.
New Data Security Requirements and Long-Term Protections
As part of the settlement agreement, TTAM Research—the nonprofit organization that now holds the genetic data—is bound by specific security requirements designed to prevent future breaches. TTAM must conduct appropriate risk analysis of its data security practices, establish a formal Advisory Board focused on data security to provide oversight, and maintain clear policies around consumer requests to delete their information.
These requirements represent an attempt by regulators to ensure that the data breach settlement includes not just compensation, but also structural changes to how the data is protected going forward. Consumers can submit requests to delete their genetic information from TTAM’s database, though the practical effectiveness of this right depends on TTAM’s compliance with deletion requests and the permanence of data deletion once it occurs. Unlike financial or medical records that may be required by law to retain for certain time periods, genetic data can theoretically be deleted entirely, though databases often retain copies in backups and archives that may persist beyond official deletion dates.
Key Dates and Deadlines for Vermont, New Hampshire, and New York Residents
The settlement was announced in July 2026, which means claims should be filed as soon as possible to avoid missing deadlines established by the settlement administrator. While no final claims deadline has been publicly announced at this time, similar settlements typically allow 12 to 18 months for claims to be filed, which would place a realistic deadline somewhere between early 2027 and mid-2027. Vermont, New Hampshire, and New York residents should visit the official settlement website regularly to check for updated deadlines, as these dates are subject to change based on court approval and settlement administration.
The February 17, 2026 deadline for the bankruptcy settlement has passed, so residents who may have missed that deadline cannot pursue compensation through that channel. The multistate settlement is now the active claims process for affected residents in these three states who were not part of the earlier bankruptcy filing process. Residents who already received compensation through the bankruptcy settlement should verify whether they are eligible to file additional claims through the multistate settlement, though many settlements prohibit double recovery from multiple settlement funds.