23andMe’s data-breach exposure grew again this week, as a coalition of more than 40 state attorneys general announced they will share in an additional $18 million resolution over alleged unreasonable security practices. The state deal follows a bankruptcy court’s approval of a separate $46.75 million settlement with private claimants, bringing the combined fallout to $64.75 million and underscoring how cyber incidents can trigger overlapping liability across private litigation, regulatory enforcement, and insolvency proceedings.

The underlying civil litigation has been centralized in the Northern District of California as IN RE: 23ANDME, Inc., Customer Data Security Breach Litigation, a multidistrict proceeding that has become a key docket for watching how courts handle privacy claims tied to alleged security failures involving highly sensitive consumer data.

The Justice Department has extradited 19-year-old Peter Stokes from Finland to the United States, where he now faces federal criminal charges in Chicago tied to the alleged cybercrime group known as Scattered Spider. According to the unsealed criminal complaint, prosecutors are pursuing conspiracy, computer intrusion, and fraud counts in what is shaping up to be one of the more closely watched federal cyber prosecutions of the moment.

The case is significant not only because of the group allegedly involved, but also because it highlights the increasingly international nature of cyber enforcement.