23andMe $50 Million Data Breach Class Action Settlement

Individuals who were customers of 23andMe between May 1, 2023, and Oct. 1, 2023, and received a notice stating a data breach may have compromised their personal information could be eligible to claim up to $10,265 from a class action settlement.

23andMe Inc., now known as Chrome Holding Co. and ChromeCo Inc., agreed to pay up to $50 million to settle a class action lawsuit alleging the company failed to adequately protect customer data, resulting in a cyberattack that exposed the personal and genetic information of approximately 6.4 million U.S. residents.

Who can file a claim?

Individuals must meet all of the following criteria:

• They were a customer of 23andMe at any time between May 1, 2023, and Oct. 1, 2023.
• They lived in the United States during that period.
• They received a notice from 23andMe stating the October 2023 data breach compromised their personal information.

There are additional subcategories within the class:

• Statutory subclass members: Individuals who resided in California, Illinois, Oregon or Alaska during the breach period and received notice that the breach compromised their information.
• Health information claimants: Individuals who received notice that the breach compromised their health information, such as raw genotype data, health reports or self-reported health condition information.

How much can class members get?

The settlement provides several types of awards, depending on the claimant's circumstances:

• Extraordinary claims: Up to $10,000 for documented, unreimbursed costs directly resulting from the breach, such as identity fraud, tax fraud, security system purchases or mental health treatment. The total cap for these claims is $8.3 million.
• Health information claims: Up to $165 for those whose health information the threat actors accessed. The total cap for these claims is $1.25 million.
• Statutory cash claims: An estimated $100 for residents of Alaska, California, Illinois or Oregon affected by the breach. The final amount may be higher or lower depending on the number of valid claims and the remaining funds.
• Privacy and medical shield plus genetic monitoring: Five years of comprehensive monitoring services (estimated retail value $1,875 per person) for all class members who enroll.

How to claim a settlement payment

Eligible class members must submit a claim form to receive compensation. There are two ways to file:

• File a claim online
• Download, print and mail the PDF claim form to the settlement administrator

Settlement administrator's mailing address: 23andMe c/o Kroll Settlement Administration LLC, PO Box 22539, New York, NY 10150-5391

What proof or documentation is required to submit a claim?

• To file a claim, class members must provide the class member ID located on their settlement notice.
• For extraordinary claims, class members must provide documentation, such as credit card statements, bank statements, receipts, invoices or other records showing unreimbursed losses directly related to the breach.
• For statutory cash claims and health information claims, class members must attest to their residency and/or receipt of a notice from 23andMe and provide the relevant address or payment information.
• Class members who wish to pre-enroll in the privacy, medical shield and genetic monitoring service should indicate this on the claim form. Even if a class member does not pre-enroll, they can still enroll at any time during the five-year service period.

Payout options

• Electronic payment (online claims only)
• Paper check (mailed claims)

$50 million settlement fund breakdown

The $50,000,000 settlement fund includes:

• Settlement administration costs: $918,000 (estimated)
• Attorneys' fees: $12,500,000
• Attorneys' expenses: Up to $500,000
• Service awards to class representatives: Up to $1,000 each ($34,000 total)
• Extraordinary claims: Up to $8,300,000
• Health information claims: Up to $1,250,000
• Statutory cash claims: Remaining funds after all other claims are paid
• Privacy, medical shield and genetic monitoring: Estimated retail value $1,875 per person

Important dates

• Deadline to opt out: Dec. 29, 2025
• Final approval hearing: Jan. 20, 2026
• Deadline to file a claim: Feb. 17, 2026

When is the 23andMe data breach settlement payout date?

The settlement administrator will distribute payments and benefits after the court grants final approval, resolves the bankruptcy reconciliation process and concludes any appeals.

Why did this class action settlement happen?

The class action lawsuit alleged a cyberattack in October 2023 exposed the personal and genetic information of about 6.4 million U.S. 23andMe customers. The plaintiffs claimed 23andMe failed to adequately protect customer data, leading to the breach.

The company denied wrongdoing but agreed to settle to avoid the risk and cost of further litigation and provide compensation and monitoring services to affected customers. The parties reached the settlement after 23andMe filed for bankruptcy and sold its assets. The new entity Chrome Holding Co. assumed the obligations.

Sources

1. Class notice
2. Settlement FAQ
3. Settlement agreement
4. Claim form