New York AG Letitia James and a 42-state coalition settled with 23andMe over the 2023 breach that exposed the genetic data of more than 6 million people.

The $18 million total isn't the story. 23andMe already went bankrupt and sold that data on to a new owner. You can't reset your DNA like a password, so the only thing worth anything here is the security obligations now bound to the data itself. Those should have been mandatory before the breach, not after.