Attorney General Russell Coleman announced on Monday that Kentuckians who had their personal information compromised will be compensated following a settlement with the U.S. Bankruptcy Trustee for 23andMe.
Coleman joined 41 other attorneys general to resolve allegations stemming from a 2023 data breach that compromised the genetic data of 6.9 million customers worldwide.
The states have approved claims totaling $150 million, but the bankrupt company does not have enough assets to satisfy all creditors. A payment of $18 million will be made immediately. Of the $18 million, Kentucky will receive $259,375.
“Kentuckians deserve to have their most sensitive personal data kept safe. When companies like 23andMe fail to maintain proper security practices, our office will take action,” Coleman said.
In October 2023, genetic testing company 23andMe announced a data breach had affected 6.9 million of their consumers, including 69,188 in Kentucky. The breach exposed a wide range of data about 23andMe customers, including genetic ancestry information, and subsets of this data were subsequently published for sale on the dark web.
An investigation by attorneys general found 23andMe failed to employ safeguards such as multifactor authentication to investigate unusual login patterns, including a massive spike in login attempts, and to properly review and test design features.
In March 2025, 23andMe filed for bankruptcy protection, and states subsequently filed claims related to the data breach investigation. As part of the bankruptcy proceedings, the assets – notably 23andMe’s consumer data – were sold to TTAM Research Institute with terms of sale including data security requirements. These terms ensure TTAM Research Institute, now re-registered as 23andMe Research Institute, will be a safer custodian of genetic data moving forward.
Coleman has issued a consumer alert to encourage Kentuckians to delete their 23andMe data. Click here for a step-by-step guide to protecting your personal information.
