Kentucky's Attorney General Secures Settlement in Genetic Data Breach Case

Kentuckians who had their personal information compromised will be compensated

Kentucky Attorney General Russell Coleman has announced Kentuckians who had their personal information compromised will be compensated following a settlement with the U.S. Bankruptcy Trustee for 23andMe. General Coleman joined 41 other attorneys general to resolve allegations stemming from a 2023 data breach that compromised the genetic data of 6.9 million customers worldwide.

The states have approved claims totaling $150 million, but the bankrupt company does not have enough assets to satisfy all creditors. A payment of $18 million will be made immediately. Of the $18 million, Kentucky will receive $259,375.

“Kentuckians deserve to have their most sensitive personal data kept safe. When companies like 23andMe fail to maintain proper security practices, our Office will take action,” said Attorney General Russell Coleman. 

In October 2023, genetic testing company 23andMe announced a data breach had affected 6.9 million of their consumers, including 69,188 in Kentucky. The breach exposed a wide range of data about 23andMe customers, including genetic ancestry information, and subsets of this data were subsequently published for sale on the dark web.

An investigation by attorneys general found 23andMe failed to employ safeguards like multifactor authentication to investigate unusual login patterns including a massive spike in login attempts, and to properly review and test design features.

In March 2025, 23andMe filed for bankruptcy protection, and states subsequently filed claims related to the data breach investigation.  As part of the bankruptcy proceedings, the assets – notably 23andMe’s consumer data – were sold to TTAM Research Institute with terms of sale including data security requirements. These terms ensure TTAM Research Institute, now reregistered as 23andMe Research Institute, will be a safer custodian of genetic data moving forward.  

Attorney General Coleman issued a consumer alert to encourage Kentuckians to delete their 23andMe data. Click here for a step-by-step guide to protecting your personal information.

Attorney General Coleman joined the attorneys general of Alaska, Alabama, Arkansas, Arizona, Colorado, Connecticut, Delaware, the District of Columbia, Florida, Georgia, Idaho, Iowa, Illinois, Indiana, Kansas, Louisiana, Massachusetts, Maryland, Maine, Michigan, Minnesota, North Carolina, North Dakota, New Hampshire, New Jersey, New Mexico, New York, Ohio, Oklahoma, Oregon, Pennsylvania, South Carolina, South Dakota, Tennessee, Texas, Utah, Virginia, Vermont, Washington, Wisconsin, and West Virginia in the settlement.