Washington will receive $547,000 as part of a 42-state settlement with 23andMe, the direct-to-consumer genetic-testing company, over its 2023 genetic-data breach. Attorney General Nick Brown led the 42-state deal with the company's bankruptcy trustee.
The Washington State Attorney General's Office announced it July 14, 2026, in its multistate settlement announcement. State officials say the breach exposed genetic and ancestry data for more than 220,000 Washington customers and about 6.9 million people worldwide. Washington's $547,000 share will fund enforcement of state consumer-protection laws, not direct payments to residents.
Official resources:
- Explore the official data from Wa — Use this primary source to review the underlying data.
- Explore the official data from Delaware — Use this primary source to review the underlying data.
Table of Contents
- How did attackers get genetic data?
- Where does the state money go?
- Is there a separate payout for consumers?
- What can you do about retained DNA data?
How did attackers get genetic data?
Attackers used credential stuffing against about 14,000 accounts, TechCrunch reported in January 2024. Credential stuffing reuses usernames and passwords leaked from other sites to break in. They then spread through the DNA Relatives sharing feature to collect about 6.9 million profiles.
Investigators later alleged unreasonable data-security practices left sensitive genetic data vulnerable. The Texas Attorney General's account says thieves offered stolen subsets for sale on the dark web.
Where does the state money go?
States received $150 million in allowed bankruptcy claims, but real recovery is far smaller. The Delaware Department of Justice explains that only $18 million will be paid immediately from limited bankruptcy funds, in its multistate bankruptcy settlement announcement.
Washington's $547,000 comes from that limited pool. The Washington State Attorney General's Office says the money will fund enforcement of consumer-protection laws. It will not fund checks to individual residents.
Is there a separate payout for consumers?
Yes, but it is separate and closed to new claims. The Illinois Attorney General's Office describes a $46.75 million class-action settlement in the bankruptcy case for affected U.S. consumers.
It covered those who submitted claims by February 17, 2026, according to the office in its bankruptcy claims settlement update. Do not expect a check from Washington's state share. That money supports future enforcement, not individual refunds. If you missed the February 17 deadline, you were not included in that consumer group.
What can you do about retained DNA data?
If you still have 23andMe data on file, you can act now. The Washington State Attorney General's Office said concerned residents can delete their account and personal information through account settings.
The advice appeared in its 2025 consumer privacy alert. Use account settings to address both items named in the alert: Start in account settings for the profile tied to your sample.
- delete your 23andMe account
- delete personal information tied to that account
You Might Also Like
- Central Maine Healthcare Data Breach Settlement Available to Maine Residents
- Data Breach Reported at Arizona State University Draws Lawyer Investigation
- New Hampshire receives more than $200 million in Meta settlement