Oregon residents who sent saliva samples to 23andMe trusted the company with their most intimate data. Now the state will get $576,707 after the genetic testing company failed to protect it.
Attorney General Dan Rayfield announced Tuesday, July 14, that Oregon joined 41 other states and the District of Columbia in an $18 million settlement with 23andMe's bankruptcy trustee over a 2023 data breach that exposed genetic and personal information for 6.9 million customers worldwide.
"Think about what people were trusting 23andMe with — not a password you can reset, not a credit card you can cancel, but the code that makes you who you are," Rayfield said. "When the company discovered its defenses had failed, its first instinct was to point fingers at customers instead of owning what had happened."
What happened
In October 2023, 23andMe disclosed that hackers had used a "credential stuffing" attack to break into customer accounts. The attackers exploited reused usernames and passwords to access accounts and steal ancestry data, DNA matches, family names, birthdates and profile pictures.
Some of the stolen data was later offered for sale on the dark web.
The multistate investigation found 23andMe had been compromised for months before detecting the breach. Investigators concluded the company engaged in unreasonable data security practices, including failing to limit login attempts and failing to implement monitoring tools that would have caught the intrusion sooner.
When 23andMe finally acknowledged the breach, the company initially blamed customers for their password habits rather than accepting responsibility, according to the Massachusetts Attorney General's office, which co-led the investigation.
The money
Oregon's $576,707 share comes from the $18 million multistate pot, to be paid from available bankruptcy funds. A separate $46.75 million class-action settlement was approved July 7 by U.S. Bankruptcy Judge Brian Walsh in the Eastern District of Missouri.
That payout, reduced by $14.29 million already disbursed, will send an additional $32.46 million to affected consumers through claims administrator Kroll, Inc.
The deadline to file a class-action claim was February 17, 2026. Consumers who missed it cannot submit new claims.
What happened to the data
23andMe filed for Chapter 11 bankruptcy in March 2025. Founder and CEO Anne Wojcicki resigned the same day the company filed. In July 2025, TTAM Research Institute, a nonprofit Wojcicki formed, purchased 23andMe's assets for $305 million. That sale included genetic data from approximately 15 million customers.
The settlement requires TTAM Research Institute to maintain enhanced data security, conduct risk analyses, add an advisory board, comply with comprehensive privacy laws and continue honoring consumer data deletion requests.
What Oregon residents can do
After the March 2025 bankruptcy filing, Rayfield issued a consumer alert outlining how Oregon customers could delete their genetic data. Consumers who want their information removed can visit 23andMe's account closure page and initiate deletion through account settings.
Once confirmed, stored genetic samples will be discarded and personal data will no longer be used for future research studies.
No Oregon-specific count of affected residents has been published. The state's share of the settlement funds will go to the Oregon Department of Justice; how those dollars are allocated was not detailed in the announcement.
