Minnesota · verified official-source register

Minnesota Privacy Enforcement Cases

3 approved, official-source case records from the 50-state register. Dates, amounts, legal context and disposition qualifications are supported by the cited evidence.

3 primary case-source links · 3 unique primary source URLs

Last editorial review (targeted corrections): · Last link check (automated availability check):

Actual case links

Minnesota case register

Each record cites an official Attorney General or state-agency source. Shared multistate amounts should not be summed as unique state penalties. Additional verification sources are identified when an amount has been reconciled.

Verified case 1 of 3

23andMe

Date
2026-07-14
Amount
$18 million paid out of available bankruptcy funds; Minnesota will receive $514,871; separate $47M class-action settlement for consumers
Legal basis
Minnesota’s Genetic Information Privacy Act; general consumer protection and privacy laws

Why the action was brought

23andMe’s 2023 credential-stuffing breach compromised genetic and other customer data, affecting 6.9 million consumers worldwide, including 92,385 Minnesotans; some data was published for sale on the dark web. The coalition alleged unreasonable security practices, including inadequate safeguards, rate limiting, monitoring, investigation of unusual logins, vulnerability remediation, and design testing.

View Official Case Source ↗ (opens in a new tab)

Verified case 2 of 3

Marriott International, Inc.

Date
2024-10-09
Amount
$52 million payment to states; Minnesota will receive $814,847.00
Legal basis
State consumer protection laws, personal information protection laws, and, where applicable, breach notification laws

Why the action was brought

From July 2014 through September 2018, intruders went undetected in Starwood’s computer network, exposing 131.5 million United States guest records, including contact information, dates of birth, reservation details, limited unencrypted passport numbers, and unexpired payment card information. Marriott allegedly failed to implement reasonable data security and remediate deficiencies, particularly while integrating Starwood into its systems.

View Official Case Source ↗ (opens in a new tab)

Verified case 3 of 3

Inmediata

Date
2023-10-23
Amount
$1.4 million payment to 32 states; Minnesota's share: $93,157
Legal basis
state consumer-protection laws, breach-notification laws, and HIPAA

Why the action was brought

Inmediata exposed protected health information of approximately 1.5 million Americans, including 113,208 Minnesotans, online and indexed by search engines for almost three years. It allegedly failed to implement reasonable data security, including secure code review, then delayed breach notification for over three months and sent misaddressed, unclear notices, exposing consumers to identity-theft risks.

View Official Case Source ↗ (opens in a new tab)

This register contains approved, official-source privacy, data-breach and data-security enforcement records. Read any case-specific court-approval qualification; inclusion does not confirm payment or final judgment. Shared multistate amounts should not be summed as unique state penalties.

Educational information, not legal advice.

Back to MinnesotaAll states

Original case-library snapshot: August 23, 2026. Original state-law research cutoff: August 25, 2026. Monetary-library update: September 16, 2026, not a new full 50-state research cutoff. Targeted Indiana and New Hampshire law review: October 19, 2026 only. Source inclusion does not independently confirm final court entry or payment.