Virginia · verified official-source register

Virginia Privacy Enforcement Cases

3 verified case records from the authoritative 50-state register. The fields below preserve the supplied amount, date, legal basis and explanation of why the action was brought.

3 official case source links · state register dated August 31, 2026

Actual case links

Virginia case register

Each record links directly to the official Attorney General or state-agency source supplied for this register. Shared multistate amounts are reproduced as stated and should not be summed as unique state penalties.

Verified case 1 of 3

23andMe

Date
July 20, 2026
Amount
$150 million in allowed claims for states, with recovery limited to $18 million from available bankruptcy funds; Virginia’s share is $662,649; separate $46.75 million class-action settlement for affected U.S. consumers
Legal basis
Virginia’s Genetic Data Privacy law, Virginia Code § 59.1-597(1); general consumer protection and privacy laws

Why the action was brought

The 2023 credential-stuffing breach compromised genetic data and other personal information of 6.9 million consumers, including 170,495 Virginians, with subsets published for sale on the dark web. 23andMe failed to use safeguards against credential stuffing, rate limiting, intrusion prevention, logging, monitoring, vulnerability remediation, and appropriate investigation of unusual login patterns.

View Official Case Source ↗ (opens in a new tab)

Verified case 2 of 3

Experian Information Solutions, Inc.; T-Mobile USA, Inc.

Date
2022-11-07
Amount
More than $15 million combined; $12.67 million from Experian and $2.43 million from T-Mobile; Virginia’s share is $346,085.82
Legal basis
None stated

Why the action was brought

An unauthorized actor accessed part of Experian’s network storing T-Mobile information for consumers applying for postpaid services and device financing. The breach exposed names, addresses, birth dates, Social Security numbers, identification numbers, and related credit-assessment information, compromising more than 15 million individuals, including 340,004 Virginians.

View Official Multistate Case Source ↗ (opens in a new tab)

Verified case 3 of 3

Equifax

Date
2019-07-22
Amount
$600 million; Virginia: $4,302,173.75; Consumer Restitution Fund of up to $425 million, including $300 million dedicated to consumer redress and up to an additional $125 million; $175 million payment to the states
Legal basis
No statutes or laws cited in the document.

Why the action was brought

Equifax's 2017 breach exposed social security numbers, names, dates of birth, addresses, credit card numbers, and some driver's license numbers of more than 147 million consumers, including over 4 million Virginians. The investigation found Equifax failed to maintain reasonable security, patch a critical vulnerability, and replace monitoring software, allowing attackers 76 days of access.

View Official Case Source ↗ (opens in a new tab)

Source data is based on verified concluded privacy, data-breach and data-security enforcement actions located on official state Attorney General or state-agency sources. Multistate settlement amounts are reproduced as stated by the official source and should not be summed as unique state penalties.

Educational information, not legal advice.

Back to VirginiaAll states