California Attorney General Rob Bonta announced on Oct 19 a settlement with Chrome Holding Co., formerly 23andMe, filed in the US Bankruptcy Court for the Eastern District of Missouri and pending court approval.

• Amount: a lump sum of $6,010,000 within 10 days of court approval. It can fund consumer relief for the 2023 breach, with any unused money going to California's consumer-protection enforcement fund.
• Resolves: California's state-court suit alleging unreasonable security and misleading statements that led to the 2023 breach, and its appeal over the sale of Californians' genetic data and samples without their affirmative consent.
• Still in force: under the Genetic Information Privacy Act, consumers can ask the buyer, 23andMe Research Institute, to delete their data, destroy their sample or withdraw research consent.

The 2023 credential-stuffing breach exposed data on about 6.9 million people (per Reuters).