LITTLE ROCK — Arkansas will receive $431,937 as part of an $18 million multistate settlement with genetic-testing company 23andMe, following a data breach that exposed sensitive personal information of millions of users, including more than 48,000 Arkansans. The settlement, negotiated by Attorney General Tim Griffin and attorneys general from 41 other states, stems from claims filed during the company’s bankruptcy proceedings.
The breach, discovered in 2023, affected approximately 6.9 million consumers nationwide and included, in some cases, genetic ancestry information, according to a statement from Griffin’s office. Initially, 23andMe denied the incident, later attributing the breach to user account configurations, Griffin said.
“In March 2025, 23andMe filed for bankruptcy protection, and states subsequently filed claims related to the data breach investigation,” Griffin explained. “Our coalition has reached an agreement by which 23andMe will pay $18 million to the states. Arkansas’s portion of the settlement will be $431,937.”
The fallout also led to a separate $46.75 million class-action settlement, offering some relief to U.S. consumers who were impacted. Under its terms, individuals who submitted claims by February 17, 2026, will be eligible for compensation approved through bankruptcy court.
“I am pleased to see this issue resolved and 23andMe held accountable for its failure to protect Arkansans’ data,” Griffin said.
This settlement serves as a reminder of the growing risks posed by data breaches, particularly in industries handling sensitive genetic and personal information.