Wisconsin secured $275,000 from 23andMe's bankruptcy estate as part of a multistate settlement announced July 14, 2026, over a 2023 data breach that exposed genetic and ancestry data for 78,407 Wisconsin residents. This payment to Wisconsin's Attorney General represents the state's share of $18 million distributed from 23andMe's bankruptcy assets to 42 state attorneys general, separate from consumer compensation available through a different class-action settlement. The breach, which compromised data for 6.9 million customers worldwide through a credential stuffing attack, exposed ancestry estimates, ethnicity reports, health predisposition data, and family tree information. Wisconsin's $275,000 reflects the limited assets available in bankruptcy proceedings and the state's proportional share of damages claimed during the investigation.
Official resources:
- Explore the official data from Wisdoj — Use this primary source to review the underlying data.
- Read the original research from Insurancejournal — Use this page to review the original research.
Table of Contents
- What Happened in the 23andMe Breach
- Wisconsin's $275,000 Settlement
- Separate Consumer Class-Action Settlement
- What 23andMe Must Do Now
- What This Means for Wisconsin Residents
- Frequently Asked Questions
What Happened in the 23andMe Breach
In October 2023, hackers used a credential stuffing attack—reusing stolen usernames and passwords from other breaches—to access 23andMe customer accounts without triggering security protections. The compromise affected 6.9 million customers worldwide, including health predisposition reports and family tree connections stored on the platform.
Wisconsin was one of the hardest-hit states, with 78,407 residents exposed. 23andMe failed to implement credential stuffing safeguards, rate limiting, intrusion prevention, or adequate logging and monitoring, according to attorneys general from across the country who investigated the incident. The company's unreasonable data security practices contributed directly to the breach's scope and impact.
Wisconsin's $275,000 Settlement
Wisconsin's $275,000 payment comes from an $18 million distribution to 42 state attorneys general from 23andMe's bankruptcy estate. This money resolves claims brought by state attorneys general investigating the breach and the company's security failures.
The payment does not go to individual Wisconsin residents; it goes to the state and may fund consumer protection efforts or restitution programs at the Attorney General's discretion. The settlement amount reflects a key limitation: 23andMe's bankruptcy estate contained only $18 million in available assets, even though states and consumers claimed $150 million in total damages. Competing creditors and limited company assets meant the payout was proportional to claims filed, not a full recovery.
Separate Consumer Class-Action Settlement
Individual Wisconsin residents affected by the breach are not eligible for compensation through the state's $275,000 settlement. Instead, a separate $46.75 million consumer class-action settlement was approved July 7, 2026, specifically for affected U.S.
customers who filed valid claims before the February 17, 2026 deadline. If you were a 23andMe customer at the time of the breach and submitted a claim by the deadline, check the bankruptcy court notices or 23andMe's settlement website for your compensation status. Consumers who did not claim by the February deadline are unlikely to receive compensation, as the claim period has closed.
What 23andMe Must Do Now
The settlement imposed concrete requirements designed to prevent future breaches. 23andMe must implement enhanced data security measures, comply with privacy laws without exception, establish an independent advisory board to oversee data protection, and maintain consumer deletion rights.
These remedial conditions are monitored as part of the bankruptcy oversight. These obligations address the security failures that enabled the 2023 breach and create ongoing accountability. However, the settlement does not restore access to deleted genetic data or reverse the breach itself; it focuses on preventing similar incidents going forward.
What This Means for Wisconsin Residents
Wisconsin residents who believe their data was compromised should check whether they filed a claim in the consumer class-action settlement by the February 2026 deadline. If you missed the deadline, you are not eligible for direct compensation from either settlement.
The state's $275,000 payment benefits Wisconsin as a whole through consumer protection resources, not individual payouts. If you are a 23andMe customer, you retain the right under the settlement terms to request deletion of your genetic data from the company's database. This is one of the few direct consumer protections still available post-breach.
Frequently Asked Questions
Can I still get money from 23andMe if I was affected by the breach?
Only if you filed a valid claim in the consumer class-action settlement by February 17, 2026. The claim filing period has closed. Check the bankruptcy court website or 23andMe's settlement page for your claim status.
What does Wisconsin's $275,000 go toward?
The payment goes to Wisconsin's Attorney General to fund consumer protection efforts or restitution programs determined by the state—not direct payments to individual residents.
Did the settlement force 23andMe to improve security?
Yes. The settlement requires enhanced data security, privacy law compliance, an independent oversight board, and maintained consumer deletion rights, monitored as part of bankruptcy proceedings.
Why is the settlement only $18 million when damages were claimed at $150 million?
23andMe's bankruptcy estate contained limited assets. The $18 million represents what is actually available to distribute; the remainder of claimed damages cannot be recovered due to the company's financial condition.