Court Approves $46.75 Million Settlement for Victims of 23andMe Data Breach
A California bankruptcy court has approved a $46.75 million (£35 million) compensation settlement for people affected by the 2023 data breach at genetic testing company 23andMe.
The ruling requires Chrome Holding, which acquired 23andMe’s assets following the company’s bankruptcy, to fund the settlement. Chrome Holding, operating as TTAM Research Institute and led by 23andMe co-founder Anne Wojcicki, purchased the company’s assets for $305 million during a bankruptcy auction last year.
Under the court order, the settlement funds must be transferred within five business days to Kroll Restructuring, which has been appointed to administer compensation payments to affected individuals.
The cyberattack, disclosed in 2023, exposed the personal data of up to 6.9 million users. Although hackers initially gained access to around 14,000 customer accounts, they were able to view the genetic profiles of relatives connected through the platform’s family-matching features, significantly expanding the scale of the breach.
Because 23andMe provides detailed DNA analysis, including information related to ancestry, health traits and family history, the incident raised widespread concerns about the security of highly sensitive genetic data.
The breach triggered multiple regulatory investigations and legal actions. In the UK, Information Commissioner’s Office imposed a £2.31 million fine on the company, concluding that it had failed to implement adequate safeguards to protect users’ personal information.
In the United States, Rob Bonta filed a lawsuit against the company in May, alleging that it failed to take basic steps to secure customer data and misled consumers about the seriousness of the cyberattack.
Despite filing for bankruptcy protection, 23andMe has continued operating its DNA testing business. Founded in 2006, the company went public in 2021 and was once valued at approximately $6 billion, although it has yet to record an annual profit.
