23andMe Data Breach Settlement Reached

A U.S. bankruptcy judge approved a $46.75 million settlement on July 7, 2026, providing compensation to victims of the 2023 data breach at genetic testing firm 23andMe. The ruling directs Chrome Holding, which acquired 23andMe’s assets after its bankruptcy, to fund the payout through Kroll Restructuring, the firm appointed to manage victim claims.

The breach exposed personal genetic profiles for up to 6.9 million people. While only about 14,000 user accounts were directly accessed, attackers also obtained data from the relatives of those users, creating a massive pool of sensitive health information. The compromised data included DNA markers linked to health conditions and family history, making the breach especially serious.

Legal actions followed the breach. California Attorney General Rob Bonta sued 23andMe for failing to protect data and for misleading consumers about the breach’s severity. The U.K.’s Information Commissioner’s Office also levied a £2.31 million fine for inadequate safeguards. The settlement represents a concrete step toward accountability for the company’s handling of personal health data.

The court ordered that the settlement funds be paid to Kroll within five business days of the ruling. Kroll will then distribute the money to the victims, ensuring that those whose genetic information was compromised receive compensation. This process reflects a growing emphasis on consumer protection in the technology and health sectors.

23andMe continues to operate after the bankruptcy, still offering DNA testing kits to consumers. However, the settlement will serve as a reminder of the importance of robust data security practices for companies that collect sensitive genetic information. It also highlights the role of regulatory oversight in safeguarding public health data.

Overall, the $46.75 million payout provides tangible relief for individuals affected by the breach and signals that companies must prioritize strong privacy measures. The settlement also demonstrates that legal systems can effectively address large‑scale data breaches, offering a path forward for victims seeking redress.