23andMe Settles Data Breach Case for $47 Million

Victims of the 23andMe data breach will receive $46.75 million in compensation following a ruling by a California bankruptcy court judge.

Victims of a 2023 data hack at genetics testing company 23andMe are set to receive a multi-million payout from the firm. A California bankruptcy court judge ruled on Tuesday that Chrome Holding, which last year took control of 23andMe after its bankruptcy, should pay out $46.75 million in compensation.

23andMe compiles genetic profiles of people through DNA testing kits, but it faced heavy criticism after hackers breached its data in 2023, affecting approximately 6.9 million users.

Representatives of Chrome Holding and 23andMe have been contacted for comment regarding the ruling. Chrome Holding operates under the name TTAM Research Institute, managed by 23andMe’s co-founder, Anne Wojcicki, who acquired the company’s assets last year for $305 million during a bankruptcy auction.

The court ruling stated that victims would see the settlement funds directed first to Kroll Restructuring, the firm representing them, within five business days from Tuesday. Kroll is responsible for distributing the settlement to the victims.

The process of appointing external companies like Kroll is typical in corporate bankruptcy cases. The BBC has reached out to the legal team advocating for the victims to clarify how many individuals will receive a portion of the payout.

23andMe filed for bankruptcy early last year, about 18 months after hackers gained access to roughly 14,000 user accounts. The breach resulted in sensitive genetic data being exposed, including health markers and family histories, which heightened concerns regarding personal privacy.

Although the number of accounts breached represented only a fraction of 23andMe’s total user base, hackers managed to access the genetic profiles of relatives of the directly affected users. This allowed them to infiltrate the data of millions hosted by 23andMe.

Following the breach, various investigations and fines ensued, including a £2.31 million fine levied by the Information Commissioner’s Office (ICO) in the UK. The ICO determined that 23andMe had failed to implement adequate security measures to protect sensitive user data before the incident.

In May, Rob Bonta, the Attorney General of California, initiated a lawsuit against the company, asserting that it had “failed to take basic steps to protect users’ data” and had allegedly misled consumers about the severity of the breach.

Despite the bankruptcy, 23andMe continues to operate, providing online DNA testing kits. The company was valued at $6 billion at its peak, having launched in 2006 and gone public in 2021, but it has never recorded a profit.