Florida is among 42 states sharing in an $18 million settlement with the genetic-testing company 23andMe over a 2023 data breach that exposed the genetic information of 6.9 million customers worldwide, according to the multistate coalition's announcement.
The agreement, announced July 14, resolves claims the states filed in 23andMe's bankruptcy. The coalition's claims were allowed at $150 million, but with the bankruptcy estate's limited funds and many competing creditors, $18 million is being distributed to the states now. Individual state shares vary, and Florida's specific allocation had not been announced publicly as of this writing.
The breach stemmed from a credential-stuffing attack: hackers used passwords exposed in unrelated breaches to enter thousands of 23andMe accounts, then leveraged the service's data-sharing features to compile information on millions of users. The company disclosed the breach in October 2023. The compromised data included names, ancestry information and, for some customers, genetic markers, and portions of it were later offered for sale online.
The settlement also binds the company's new custodian to enhanced security requirements, regular risk assessments, an independent data-security advisory board and continued honoring of customers' data-deletion rights. 23andMe filed for bankruptcy in March 2025.
Separately, a bankruptcy judge on July 6 approved a $46.75 million class-action settlement covering affected consumers across the country who submitted claims by February 17, 2026.
