23andMe data breach: Settlement could bring data breach victims $10,000

After a data breach exposed the personal information of about half of its users and led to simmering distrust of the popular parentage service, 23andMe confirmed last month that it would settle a $30 million class-action lawsuit accusing the company , not adequately protecting its users.

The San Francisco-based company, which allows users to submit genetic material and get a snapshot of their ancestry, said in October 2023 that hackers had accessed customer information in a data breach, but the company did not confirm the full extent of the incident until December. About half of the company’s 14 million users saw their personal information exposed in the leak, which first began in April 2023.

The lawsuit, which accuses the company of not doing enough to protect its customers, was filed in January of this year. The lawsuit also accused 23andMe of failing to inform certain customers of Chinese or Ashkenazi Jewish descent that their data was being targeted and distributed on the dark web.

Under the proposed settlement, which is subject to preliminary court approval, the company will provide up to $10,000 and other security services to eligible customers depending on the hardships incurred. In the wake of this ordeal, the independent directors of the company’s board resigned and concerns about 23andMe’s ability to store your personal information became a trending topic.

“We have entered into a settlement agreement for a total cash payment of $30 million to resolve all U.S. claims related to the credential stuffing security incident in 2023,” a 23andMe spokesperson told CNET. “We continue to believe that this settlement is in the best interests of 23andMe customers and look forward to completing the agreement.”

Here’s what we know about the terms of 23andMe data billing. For more information on current comparisons, see How You May Be Able to Claim Money from CashApp and Who Is Eligible for a Brokerage Fee Statement.

How many people were affected by the 23andMe data breach?

The settlement affects approximately 6.9 million 23andMe users whose data was affected by the leak. To qualify for the proposed settlement, 23andMe users must also have resided in the United States as of August 11, 2023.

That number of 6.9 million includes around 5.5 million users of 23andMe’s DNA relative profiles, which allow users to find and contact genetic relatives. The other 1.4 million people affected by the breach used a different service called Family Tree, which predicts a family tree based on the DNA that users share with relatives, 23andMe said.

How much money could you receive as part of the severance package?

At the high end, 23andMe has said it will pay out up to $10,000 with an “extraordinary claim” to users who can prove they suffered hardship as a direct result of the data theft that resulted in unreimbursed costs. These include costs incurred through “identity fraud or falsified tax returns,” the purchase of physical security systems, or mental health treatment.

Residents of Alaska, California, Illinois and Oregon affected by the breach can also seek payment under the proposed settlement because those states have genetic privacy laws with tort provisions. Payments for those people are expected to be about $100, depending on how many people apply, a settlement document said.

Additionally, a smaller group of affected users whose personal health information was affected by the breach may request a payment of $100.

Infographic source: Gianmarco Chumbe/CNET; Background image: Jason Doiy/Getty Images

Will there be anything else included in the bill?

Beyond these payments, 23andMe will also offer affected users a security monitoring service called Privacy Shield for three years, which the filing describes as “significant web and dark web monitoring.”

Can you already submit a settlement application?

There is currently no opportunity to request payment under this proposed settlement. CNET will provide updates on this aspect of the story as they become available.

For more information, see this explanation of how class action lawsuits work.