23andMe’s data-breach exposure grew again this week, as a coalition of more than 40 state attorneys general announced they will share in an additional $18 million resolution over alleged unreasonable security practices. The state deal follows a bankruptcy court’s approval of a separate $46.75 million settlement with private claimants, bringing the combined fallout to $64.75 million and underscoring how cyber incidents can trigger overlapping liability across private litigation, regulatory enforcement, and insolvency proceedings.

The underlying civil litigation has been centralized in the Northern District of California as IN RE: 23ANDME, Inc., Customer Data Security Breach Litigation, a multidistrict proceeding that has become a key docket for watching how courts handle privacy claims tied to alleged security failures involving highly sensitive consumer data.