California Settles 23andMe Data Breach Lawsuit for $6 Million

Posted by Steve Alder

In July, a coalition of 42 state attorneys general agreed to an $18 million settlement with 23andMe to resolve claims that the company violated state laws by failing to implement appropriate data security measures to prevent credential-based attacks. California did not participate in the action, having opted to pursue its own legal claims against the company. A settlement has now been agreed between 23andMe and California to resolve the alleged violations of California laws.

The data breach, covered by the HIPAA Journal in this post, exposed the personal information and genetic information of approximately 6.9 million individuals, including 855,000 California residents. While the attack involved credential stuffing and took advantage of 23andMe customers’ poor password security practices, the states argued that the company should have been aware that there was a risk of customer accounts being targeted, and the company should therefore have implemented security measures for detecting and blocking attacks on customer accounts.

Following the security incident, 23andMe filed for bankruptcy protection and the company was bought for $305 million by TTAM Research Institute, a non-profit controlled by 23andMe co-founder Anne Wojcicki. California attempted to block the sale of the company, claiming it violated the California Genetic Information Privacy Act because 23andMe customers had not given their consent to the sale, which involved the transfer of their personal and genetic information to TTAM Research Institute. The state’s attempt to block the sale was unsuccessful, and a bankruptcy court judge ruled that California could not sue TTAM Research Institute over the data breach to recover money.

California planned to appeal the ruling; however, under the data breach settlement agreement, the state has agreed to drop further appeals. Under the terms of the settlement, California will be paid $6 million. While the sale of the company and transfer of customer data to TTAM Research Institute will go ahead, 23andMe customers have the right to request that their personal and genetic data be deleted.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

“I am proud to fight for the privacy rights of Californians and to deliver this settlement for consumers ​who put their trust in 23andMe,” said California Attorney General Rob Bonta. “I want to remind Californians that customers of 23andMe can delete their private, genetic data — no matter who owns it.” In addition to the $24 million in settlements, 23andMe agreed to settle class action data breach litigation and will pay $46.75 million to its customers. The settlement was approved by the court in July 2026.

The post California Settles 23andMe Data Breach Lawsuit for $6 Million appeared first on The HIPAA Journal.

Central Ohio Primary Care Physicians Data Breach Affects 1.4 Million Patients

Posted by Steve Alder

Central Ohio Primary Care Physicians, one of the largest independent physician-owned primary care medical groups in the United States, has experienced a cybersecurity incident that involved the personal and protected health information of approximately 1.4 million current and former patients, according to local media reports.

The Westerville, Ohio-based medical group, which has more than 80 locations in Central Ohio, experienced a voice phishing (vishing) attack in August 2026 that resulted in unauthorized third-party obtaining credentials that provided access to internal systems. The unauthorized access was detected and blocked on August 25, 2026.

The investigation into the incident confirmed that files containing patient information were exfiltrated in the incident. The files have now been reviewed and found to contain patient names, addresses, Social Security numbers, financial information, health information, and other identifying information.

Notification letters are being mailed to the affected individuals, and complimentary credit monitoring, identity theft protection, and dark web monitoring services are being made available. Central Ohio Primary Care Physicians said it has not detected any misuse of patient information as a result of the incident at the time of issuing notification letters. Central Ohio Primary Care Physicians said it takes data privacy and security seriously and had implemented appropriate security measures prior to the incident. Security has since been enhanced to reduce the risk of similar incidents in the future.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

The threat group behind the attack was not disclosed in the breach notices; however, it appears to be a ransomware group called Chaos. The group added Central Ohio Primary Care Physicians to its dark web data leak site and threatened to publish the stolen data if payment was not made. The group claimed that contact had not been made at the time of the listing, but Central Ohio Primary Care Physicians is no longer listed on the site.

The post Central Ohio Primary Care Physicians Data Breach Affects 1.4 Million Patients appeared first on The HIPAA Journal.

$80 Million Settlement Proposed to Resolve Conduent Data Breach Litigation

Posted by Steve Alder

An $80 million settlement has been proposed to resolve a consolidated class action lawsuit against Conduent Business Services, LLC, over its 2024 cybersecurity incident and data breach. Conduent, a leading provider of front-office and back-office solutions, notified the U.S. Securities and Exchange Commission (SEC) in April that it had experienced a cybersecurity incident. An unauthorized third party first breached its network on October 21, 2024, and maintained access until January 13, 2025. The SafePay ransomware group claimed to have exfiltrated 8.5 terabytes of data in the attack.

Conduent’s forensic investigation determined that the personal and protected health information of approximately 62.2 million individuals was stolen in the incident, including names, addresses, dates of birth, medical information, health insurance information, and Social Security numbers. It was the largest healthcare data breach reported in 2025 and ranks as the third-largest healthcare data breach of all time.

Conduent Business Services LLC, Conduent State & Local Solutions, Inc., and Conduent Incorporated faced multiple class action lawsuits in response to the data breach. The lawsuits were consolidated into a single complaint – In Re Conduent Business Services Data Breach Litigation – as they had overlapping claims and classes. The lawsuit is pending in the U.S. District Court for the District of New Jersey.

The consolidated lawsuit alleged that the defendants failed to implement reasonable and appropriate safeguards to protect individuals’ sensitive personal and protected health information. The lawsuit had 16 causes of action, including negligence and violations of the California Consumer Privacy Act, California Confidentiality of Medical Information Act, and California Customer Records Act. The defendants disagree with the claims and contentions in the lawsuit, including claims of wrongdoing and liability.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

The $80 million settlement was proposed following mediation and covers the 62.2 million individuals affected by the breach, approximately 40 million of whom are in Subclass A and 22 million are in Subclass B. Individuals in Subclass A had data stolen in the attack, but it was stored in complex backup files that made their data difficult to access. Individuals in Subclass B had private information stolen in a readily accessible format.

All class members are entitled to claim one year of single-bureau credit monitoring services, valued at $179.40 per year. All class members may also submit a claim for reimbursement of documented, unreimbursed losses due to the data breach up to a maximum of $3,500 per class member. Members of subclass B may also submit a claim for a pro rata cash payment, the value of which will depend on the remaining funds after attorneys’ fees and expenses, settlement administration costs, service awards for the class representatives, credit monitoring services, and claims have been paid. The attorneys are seeking 34% of the settlement fund, and the class representatives will be paid $1,500 each. Individuals who were California residents at the time of the breach will also be eligible for an additional payment, equal to the pro rata cash payment plus 20%. The settlement awaits approval from the court, after which the dates for objection, exclusion, and submitting a claim will be set.

The post $80 Million Settlement Proposed to Resolve Conduent Data Breach Litigation appeared first on The HIPAA Journal.