Texas says it secured a $150 million settlement from 23andMe. So does Virginia. So does Delaware. So does every one of the roughly 42 states that signed onto the same multistate agreement this summer over the company’s 2023 data breach — and yet Texas is receiving $1,266,860, Virginia $662,649, and Delaware $159,654. Add up every state’s actual check and the total comes to $18 million, not $150 million. Both numbers are true. They’re just answers to different questions, and the gap between them is the real story of what 23andMe’s genetic-data breach has cost the company, and what it hasn’t cost the roughly 6.9 million people whose data was exposed.

Two Settlements, Not One

This series covered the collapse of 23andMe in detail last June, from the October 2023 credential-stuffing breach through the company’s March 2025 bankruptcy filing and its contested $305 million sale to TTAM Research Institute, a nonprofit formed by 23andMe’s own co-founder and now operating as 23andMe Research Institute.^[1] That article ended with the sale freshly closed and the privacy commitments TTAM had made still mostly theoretical. This summer, two separate settlements turned some of those questions into numbers.

The first is a multistate settlement between 23andMe (now wound down in bankruptcy as Chrome Holding Co.) and a coalition of state attorneys general — reported as 42 states in most releases, 43 in a few, likely reflecting how the District of Columbia or a late joiner gets counted. State offices announced their piece of it in a rolling wave between July 14 and July 20, 2026.^[2][3] The second is a federal consumer class-action settlement, entirely separate, that a bankruptcy judge gave final approval on July 6, 2026: $46.75 million set aside for the people whose accounts were actually compromised.^[4] Both trace back to the same breach. Neither is the other.

The $46.75 million figure also has its own history worth knowing. The class action was originally negotiated before 23andMe’s bankruptcy filing, at a lower amount, and had to be revisited once Chapter 11 put the whole case inside a bankruptcy court’s jurisdiction rather than a standard civil docket. Coverage from mid-2025 described 23andMe seeking approval of what was then reported as a larger, roughly $50 million settlement; by the time Judge Walsh granted final approval this July, the figure had settled at $46.75 million.^[4][5] None of the sources reviewed for this article lay out every step of that renegotiation in a single, fully reconciled timeline — a reminder that litigation moving through a bankruptcy proceeding rarely produces a tidy paper trail, even when the eventual number is precise to the dollar.

Why $150 Million Becomes $18 Million

The discrepancy isn’t a reporting error, and it isn’t spin — it’s how bankruptcy claims work. When the states sued, a court recognized their claim against 23andMe’s estate as worth $150 million. That figure is what lawyers call an “allowed claim”: a formal statement of what the states are owed, not a guarantee of what they’ll collect. A bankrupt company’s estate gets divided among every creditor with a claim against it, in an order of priority, and by the time the states’ turn came, there wasn’t $150 million left to divide. There was $18 million. The states each got their share of what was actually available, not their share of what they were technically owed — roughly twelve cents on the dollar.

It’s a genuinely confusing quirk of bankruptcy law, and every state’s press release is accurate on its own terms. Texas’s headline, “$150 Million Settlement,” describes the claim; its subhead, if you read past the second paragraph, describes the $1.27 million check.^[3] Readers who stop at the headline number come away with an impression roughly eight times too generous — which is presumably part of why the headline number is the one everyone used.

What Nearly Seven Million People Actually Get

The state settlements don’t pay affected consumers directly; that money goes to state treasuries and attorney general offices. The separate $46.75 million class-action settlement is the one meant for the roughly 6.9 million people whose accounts were part of the breach, and its payout structure is tiered. Most eligible claimants can expect a baseline statutory payment of roughly $100. Those whose exposed data included health information can claim up to $165. A small extraordinary-loss tier goes up to $10,000, but only for claimants who can document concrete harm — actual identity theft or verifiable out-of-pocket losses, not general inconvenience or worry.^[5] As of a June 10, 2026 filing, the settlement administrator, Kroll Restructuring Administration, reported more than 255,860 claims already resolved, with thousands still pending.^[4]

Anyone who tested with 23andMe before October 2023 and hasn’t checked their claim status should do it directly through Kroll’s official settlement site — not through a link in an unsolicited email or text, several of which have reportedly circulated trading on the settlement’s own publicity. The legitimate process doesn’t ask for banking details up front.

The Five Habits That Cost $18 Million

The states’ investigation didn’t allege that 23andMe was hacked by some novel or sophisticated attack. It alleged the opposite: that the breach succeeded because of the absence of security practices that have been considered standard for years. The states’ findings named five specific gaps: no screening of customer passwords against lists of credentials already known to be compromised elsewhere; no requirement for multi-factor authentication; no rate-limiting or intrusion-prevention systems to slow down repeated login attempts; no monitoring for unusual login patterns, which let the credential-stuffing campaign run undetected for roughly five months between April and September 2023; and known vulnerabilities that went unpatched.^[2]

One detail in the states’ findings is worth dwelling on for a genealogy audience specifically. 23andMe’s DNA Relatives feature, which surfaces potential family matches between users, meant that a single compromised account with a reused password could expose data belonging to people who had never reused a password anywhere — because their genetic match data was visible through someone else’s account. The breach’s scope grew not because 6.9 million people all made the same mistake, but because the platform’s own matching feature turned individual account failures into a shared vulnerability across entire family networks. It’s a pointed reminder for anyone using DNA-matching tools on any platform, not just 23andMe: your account security isn’t only about protecting your own data.

What Follows the Data

The more consequential part of both settlements may be the forward-looking requirements rather than the money. 23andMe Research Institute is now bound to specific, court-enforceable commitments: comprehensive risk-assessment procedures, an independent data-security advisory board, continued honoring of existing customers’ rights to delete their data, and ongoing compliance with state privacy laws.^[2][3] Legal analysts have flagged the structure as notable less for its content — these are fairly standard security practices — than for the fact that it binds the successor organization, not the company that actually committed the failures. The obligations traveled with the genetic data through a bankruptcy sale and attached themselves to whoever ended up holding it. That’s a real precedent, and one with obvious relevance the next time a data-holding company goes bankrupt.

It’s also an unproven one. 23andMe Research Institute is a nonprofit with a different funding model, a different mission, and a leaner staff than the for-profit company whose failures triggered this settlement in the first place. Whether “an Advisory Board” and “comprehensive risk analysis procedures” translate into fewer five-month undetected breaches five years from now is a question the settlement documents can’t answer; only the next audit, or the next breach, will.

The Real Bill

Add the two settlements together and the headline is genuinely large: nearly $65 million in combined recovery, plus separate penalties from UK and Spanish regulators, plus a binding set of security commitments a bankruptcy court can enforce. For a company that no longer exists in its original form, that’s a real reckoning. But measured against the people the breach actually happened to, the arithmetic is more modest: a baseline payment around $100 for most of the 6.9 million affected, a state recovery worth about twelve cents on every dollar the courts said those states were owed, and a promise of better security from an organization that has not yet had the chance to prove it.

There’s also a question this settlement doesn’t answer, because no settlement could: what happens to the genetic and family-match data of the people who don’t file a claim at all, whether because they never heard about it, distrust anything arriving by email with a settlement link attached, or simply moved on. Kroll’s tally of a quarter-million resolved claims, against a pool of 6.9 million potentially eligible people, suggests that group is still the majority. For a genealogical audience whose entire practice depends on other people’s willingness to test, share, and stay reachable, that’s arguably the more consequential number in this whole story, and it’s the one none of this summer’s press releases put a dollar figure on.

The practical lesson for anyone with a stake in genetic genealogy isn’t really about waiting for a settlement check. It’s the same one this series has made before about ethnicity estimates and AI-generated stories: read past the headline number, because the fine print is where the real figure usually lives.

Sources

1. Dillman Family Association. “23andMe Under TTAM: What Happened and What It Means.” June 2026. dillmanfamilyassociation.org.
2. State of Delaware, Department of Justice. “AG Jennings Announces Multistate Settlement of Bankruptcy Claims Against 23andMe Over Genetic Data Breach.” State of Delaware News. July 14, 2026. news.delaware.gov.
3. Office of the Attorney General of Texas. “Attorney General Paxton Secures $150 Million Settlement Against 23andMe Over Data Breach That Exposed Genetic Information of 6.9 Million People.” July 15, 2026. texasattorneygeneral.gov.
4. Recording Law. “23andMe Data Breach Settlement Approved by Bankruptcy Judge for $46.75 Million.” Accessed September 2026. recordinglaw.com.
5. Insurance Journal. “Claimants of 23andMe Data Breach to Get $46.75M in Settlement Deal.” June 12, 2026. insurancejournal.com.
6. HIPAA Journal. “23andMe Pays $18 Million to Settle Multistate Data Breach Lawsuit.” Accessed September 2026. hipaajournal.com.

AI Disclosure: This article was researched and written with the assistance of Claude, an AI assistant developed by Anthropic, drawing on public settlement announcements from multiple state attorneys general and legal/industry news coverage published in June and July 2026. Where sources reported slightly different figures (for example, 42 versus 43 participating states, or the range of individual payout tiers), this article notes the discrepancy rather than picking one figure silently.