Attorney General Raúl Labrador announced Monday that Idaho will recover more than $616,000 through two separate multistate consumer protection settlements targeting Block, Inc., the parent company of Cash App, and genetic testing firm 23andMe.

Cash App Settlement

Idaho joined a coalition of 46 states in a $45 million agreement with Block, Inc. over the company’s handling of Cash App fraud and consumer safety. Idaho’s share of that settlement totals $416,856.

Investigators found that Block misled users about the safety of the Cash App platform and failed to deliver on promised fraud protections. The platform required only minimal identity verification at sign-up, leaving accounts more vulnerable to exploitation.

Among the specific failures cited: Block ran a promotion encouraging users to publicly post their account identifiers — information that scammers later used to target victims. The company also offered no phone support for customers for years, leaving defrauded users with limited options for recourse.

Separately, Block reached an agreement with the Consumer Financial Protection Bureau that requires the company to distribute between $75 million and $120 million directly to affected consumers nationwide.

23andMe Genetic Data Breach

The second settlement addresses a 2023 data breach at 23andMe that exposed the genetic data of nearly 6.9 million customers worldwide, including 38,537 Idahoans. Idaho joined 41 other states in resolving claims against the company through its bankruptcy proceedings, securing $200,000 for the state from an $18 million pool allocated to states from 23andMe’s bankruptcy estate.

The breach resulted from a cascade of security failures. According to investigators, 23andMe did not require multifactor authentication, failed to defend against credential stuffing attacks — in which hackers use previously stolen login credentials to access other accounts — and did not detect an unusually large spike in login attempts before the breach escalated. The company also left known security vulnerabilities in place prior to the intrusion.

Hackers accessed and subsequently sold customers’ genetic ancestry data on the dark web. The sensitivity of the exposed data — genetic information is among the most personal data a consumer can share — drew particular scrutiny from state attorneys general involved in the multistate investigation.

Following the settlement announcement, Labrador issued a consumer alert encouraging Idahoans who used 23andMe to withdraw their consent for the storage or sale of their genetic data.

Labrador’s Statement

“Idaho families trusted these companies with their money and their most personal information, and both companies failed them,” Labrador said in announcing the settlements.

The attorney general has made consumer data protection a recurring priority. His office has pushed federal regulators to strengthen rules against robocall scammers and has issued warnings to residents about permit fraud targeting development applicants in the Treasure Valley.

What’s Next

For Cash App users, the CFPB’s separate consumer distribution process will determine how individual refunds or payments are administered at the federal level. Idahoans affected by the 23andMe breach who wish to limit further use of their genetic data are encouraged to take action through the company’s consent and data management settings while the bankruptcy process continues.

The two settlements together reflect a broader multistate trend of attorneys general coordinating enforcement actions against technology and financial platforms that collect sensitive consumer data. Idaho’s recoveries — nearly $417,000 from the Cash App case and $200,000 from the 23andMe case — will flow to the state under the terms of each agreement.