A U.S. bankruptcy judge has approved a $32.46 million settlement for 6.9 million 23andMe customers whose sensitive genetic and personal data were exposed during a 2023 security breach.

Key Points

• The breach involved attackers using leaked passwords to access 14,000 accounts, subsequently scraping data from 6.9 million users via the DNA Relatives feature.
• Exposed information included ethnicity estimates, family surnames, birth years, and locations, with users of Chinese and Ashkenazi Jewish heritage disproportionately targeted.
• Eligible claimants will receive cash payments, with some receiving up to $100, alongside five years of genetic monitoring services valued at approximately $1,875.
• Extraordinary claims for documented identity theft are eligible for up to $10,000, though the overall filing window for these claims has already closed.
• The settlement is funded by the bankruptcy estate of the former company, now known as Chrome Holding Co., following its Chapter 11 filing in March 2025.

Why it Matters

This settlement highlights the significant legal and financial liabilities companies face when failing to protect highly sensitive biometric and ancestral data. It also underscores ongoing regulatory concerns regarding the privacy of genetic information during corporate bankruptcy proceedings and asset sales.