Oklahoma will receive $276,435 from a multistate settlement resolving claims that 23andMe failed to protect customers’ sensitive genetic information, Attorney General Gentner Drummond announced Thursday.
What the settlement covers
The payout stems from a disclosure first made public in October 2023, when 23andMe said hackers had accessed data for about 6.9 million customers. State officials say more than 78,000 people in Oklahoma had their data affected.
States involved in the action agreed to terms that open up to $150 million in potential claims. However, because the company filed for bankruptcy in March 2025, available payouts are being capped at $18 million overall.
"When Oklahomans signed up for 23andMe and shared their DNA, they trusted the company to protect some of the most personal information a person can share. Instead, that trust was betrayed. This settlement won't undo the damage, but it holds 23andMe accountable and puts guardrails in place to prevent this from happening again," said Attorney General Gentner Drummond.
Company changes and separate class action
23andMe's assets, including customer data, were sold to the nonprofit TTAM Research Institute — founded by the company's former CEO — after the bankruptcy. That organization later re-registered under the name 23andMe Research Institute and agreed to adopt stronger data protections going forward.
Among the new measures announced are options for customers to delete their genetic profiles and the establishment of an independent advisory board to oversee security practices. In addition to the state settlement, the company agreed to a separate class-action payment of $46.75 million for customers who filed claims by Feb. 17, 2026.
Practical implications for Oklahomans
For anyone in Oklahoma who used 23andMe, the settlement means a modest direct payout for the state’s share and, more importantly, new safeguards aimed at preventing a repeat of the breach. Consumers who are concerned about past or future exposure should consider the following steps:
- Review account settings on 23andMe or the 23andMe Research Institute and use any available controls to delete or limit stored data.
- Monitor financial and medical records for unusual activity tied to identity misuse.
- Follow guidance from the Attorney General’s office or the company for filing individual claims if eligible under settlement terms.
| Item | Figure |
|---|---|
| Customers affected (company-wide) | 6.9 million |
| Oklahomans affected | 78,000+ |
| Total potential claims | $150 million |
| Payouts limited to | $18 million |
| Oklahoma's share | $276,435 |
| Separate class-action payment | $46.75 million |
This settlement highlights growing scrutiny of how companies handle genetic and health-related data. For many Oklahomans, the focus now shifts from compensation to ensuring stronger protections are enforced and that consumers understand their options for controlling or removing sensitive information.
