Virginia · verified official-source register

Virginia Privacy Enforcement Cases

3 approved, official-source case records from the 50-state register. Dates, amounts, legal context and disposition qualifications are supported by the cited evidence.

3 primary case-source links · 3 unique primary source URLs

Last editorial review (targeted corrections): · Last link check (automated availability check):

Actual case links

Virginia case register

Each record cites an official Attorney General or state-agency source. Shared multistate amounts should not be summed as unique state penalties. Additional verification sources are identified when an amount has been reconciled.

Verified case 1 of 3

23andMe

Date
July 20, 2026
Amount
$150 million in allowed claims for states, with recovery limited to $18 million from available bankruptcy funds; Virginia’s share is $662,649; separate $46.75 million class-action settlement for affected U.S. consumers
Legal basis
Virginia’s Genetic Data Privacy law, Virginia Code § 59.1-597(1); general consumer protection and privacy laws

Why the action was brought

The 2023 credential-stuffing breach compromised genetic data and other personal information of 6.9 million consumers, including 170,495 Virginians, with subsets published for sale on the dark web. 23andMe failed to use safeguards against credential stuffing, rate limiting, intrusion prevention, logging, monitoring, vulnerability remediation, and appropriate investigation of unusual login patterns.

View Official Case Source ↗ (opens in a new tab)

Verified case 2 of 3

Experian Information Solutions, Inc.; T-Mobile USA, Inc.

Date
2022-11-07
Amount
More than $15 million combined; $12.67 million from Experian and $2.43 million from T-Mobile; Virginia’s share is $346,085.82
Legal basis
None stated

Why the action was brought

An unauthorized actor accessed part of Experian’s network storing T-Mobile information for consumers applying for postpaid services and device financing. The breach exposed names, addresses, birth dates, Social Security numbers, identification numbers, and related credit-assessment information, compromising more than 15 million individuals, including 340,004 Virginians.

View Official Multistate Case Source ↗ (opens in a new tab)

Verified case 3 of 3

Equifax

Date
2019-07-22
Amount
$600 million; Virginia: $4,302,173.75; Consumer Restitution Fund of up to $425 million, including $300 million dedicated to consumer redress and up to an additional $125 million; $175 million payment to the states
Legal basis
No statutes or laws cited in the document.

Why the action was brought

Equifax's 2017 breach exposed social security numbers, names, dates of birth, addresses, credit card numbers, and some driver's license numbers of more than 147 million consumers, including over 4 million Virginians. The investigation found Equifax failed to maintain reasonable security, patch a critical vulnerability, and replace monitoring software, allowing attackers 76 days of access.

View Official Case Source ↗ (opens in a new tab)

This register contains approved, official-source privacy, data-breach and data-security enforcement records. Read any case-specific court-approval qualification; inclusion does not confirm payment or final judgment. Shared multistate amounts should not be summed as unique state penalties.

Educational information, not legal advice.

Back to VirginiaAll states

Original case-library snapshot: August 23, 2026. Original state-law research cutoff: August 25, 2026. Monetary-library update: September 16, 2026, not a new full 50-state research cutoff. Targeted Indiana and New Hampshire law review: October 19, 2026 only. Source inclusion does not independently confirm final court entry or payment.