Delaware Reach Settlement in 23andMe Data Breach Case | Eastern Shore…

Delaware AG reaches $150m multistate settlement with 23andMe over October 2023 data breach affecting 6.9m customers; company failed to implement basic security controls (MFA, rate limiting, credential stuffing protection) and mishandled initial disclosure. 23andMe's consumer data is now held by TTAM Research Institute (founded by former CEO Anne Wojcicki) with court-mandated privacy protections. If you're collecting genetic or health data at scale, you now have a precedent showing that basic security costs nothing but its absence costs tens of millions. The settlement also signals that state AGs will scrutinise data sales out of bankruptcy - if your consumer data has resale value, plan for that transfer to come with regulatory strings attached.