Arkansas to Receive $431,937 From 23andMe Settlement; Consumer Claims Are Separate

Arkansas will receive $431,937 from a multistate settlement with 23andMe over a 2023 genetic-data breach, Attorney General Tim Griffin announced July 27. The money is for the state, not an automatic check for the more than 48,000 Arkansans identified as affected by the breach.

Any money or benefits available to individual consumers come through a separate, court-authorized class-action settlement. That process produced a $46.75 million settlement approved in bankruptcy court, and the settlement administrator expects payments to be distributed in September 2026. Residents should verify their own claim status rather than assume they will receive a payment.

What Arkansas officials announced

Griffin said Arkansas joined 41 other state attorneys general and the District of Columbia in reaching an $18 million settlement with 23andMe. Arkansas’s share is $431,937.

The Arkansas Attorney General’s Office said the breach affected approximately 6.9 million consumers, including more than 48,000 Arkansans. The compromised information varied by customer and could include genetic ancestry information and other personal details.

The settlement resolves state claims arising from the multistate investigation. The states alleged that 23andMe failed to use adequate safeguards against attacks involving stolen credentials, did not sufficiently limit or prevent suspicious access, failed to address known vulnerabilities and did not properly investigate unusual login activity.

Those allegations were resolved through the settlement; they are not the same as a criminal judgment against the company.

The state payment is separate from consumer claims

Arkansas’s $431,937 share should not be described as a direct payment to affected Arkansans. The announcement does not create a new Arkansas consumer claim program or state-specific payout.

The separate consumer case was handled through the U.S. Bankruptcy Court for the Eastern District of Missouri. The court-authorized settlement website says the final settlement amount was approved at $46.75 million on July 7, 2026. The website also says payments are expected in September, although that is an expectation rather than a guarantee that every payment will arrive on a particular date.

The court settlement website uses a different denominator from the Arkansas Attorney General’s announcement. It describes the breach as involving approximately 6.4 million U.S. residents, while Arkansas officials cited 6.9 million consumers overall. The figures refer to different populations.

What Arkansas residents should know now

The deadline to submit a consumer claim was February 17, 2026, and that deadline has passed. The state settlement does not reopen the claim period.

The consumer settlement includes several categories of possible relief:

Extraordinary claims: Reimbursement of documented, unreimbursed costs related to the breach, with payments of up to $10,000 under the settlement’s rules.
Health-information claims: Payments of up to $165 for eligible people who were notified that health information was involved.
Statutory cash claims: An estimated $100 payment category for eligible residents of Alaska, California, Illinois or Oregon. Arkansas is not included in that category.
Privacy and monitoring benefits: Five years of Privacy & Medical Shield and Genetic Monitoring for eligible settlement class members who submitted the required claim or enrollment information.

Eligibility depends on the person’s circumstances and the type of claim filed. The settlement website says a person generally had to be a 23andMe customer between May 1 and October 1, 2023, reside in the United States during that period and receive notice from 23andMe that personal information was compromised.

Doing nothing does not produce an automatic cash payment. The court-authorized website says a claim had to be filed to receive a cash payment, although eligible class members who did nothing may retain an opportunity to participate in the monitoring services. Arkansas residents who received breach notification should use the authorized settlement website to review their claim information and monitor payment updates.

New requirements for the organization holding the data

The multistate settlement also imposes obligations on the successor organization holding 23andMe customer data. After 23andMe entered bankruptcy, its customer data was sold to TTAM Research Institute, a nonprofit formed by 23andMe’s founder and former chief executive. The organization is now known as 23andMe Research Institute.

Under the settlement, the successor organization must conduct appropriate risk analyses, establish a data-security advisory board and continue offering consumers the right to delete their information. The requirements apply to the organization now serving as custodian of the genetic data rather than treating the former corporate structure as unchanged.

What happens next

For Arkansas residents, the next step is not filing a new claim. It is checking the court-authorized settlement website for claim-status and distribution information. The site identifies itself as the only authorized website for this settlement.

Residents should be cautious with unsolicited texts, emails or social-media messages seeking personal information or payment details. The Arkansas settlement payment goes to the state, while any individual recovery depends on the separate federal consumer process and the claim category involved.

Sources

Discover more from Interactive News

Subscribe to get the latest posts sent to your email.