23andMe Data Breach Settlement — $46.75M (Closed)

View Open Settlements
Data Breach · Settlement Closed

23andMe Data Breach Settlement — $46.75M Distribution, Up to $10,000

Published November 29, 2025
Updated June 29, 2026

About 6.4 million U.S. 23andMe customers whose data was exposed in the 2023 breach were eligible for cash payments up to $10,000 and five years of genetic monitoring — but the February 17, 2026 claim deadline has passed and the settlement is now closed.

23andMe data breach class action settlement — genetic and ancestry data exposed in the 2023 cyberattack
Status Final Approval Granted — Payments Pending Approved Jan 30, 2026 · payments held until bankruptcy reconciliation completes
Claim Deadline February 17, 2026 (passed)
Settlement / Distribution $46.75 million (capped at $50M) ~$32.5M to resolve class claims · more than $14M to administrator Kroll
Estimated Payout ~$100 to $10,000 Statutory Cash ~$100 · Health Info up to $165 · Extraordinary Claims up to $10,000 · plus 5 yrs genetic monitoring
Proof Required Yes Class Member ID from the mailed/emailed notice was required to file; Extraordinary Claims required documentation

What Was This Settlement About?

In October 2023, 23andMe disclosed a cyberattack that exposed the personal information of about 6.4 million customers in the United States. Plaintiffs alleged the incident affected sensitive personally identifiable information such as genetic data, ancestry reports, and family tree details, some of which later appeared for sale on the dark web. Multiple lawsuits were filed and consolidated as a nationwide class action.

In March 2025, 23andMe filed for Chapter 11 bankruptcy in the U.S. Bankruptcy Court for the Eastern District of Missouri. During the bankruptcy the company sold its assets and changed its legal name to Chrome Holding Co. and ChromeCo, Inc.; for ease of reference the settlement notice still refers to the company as 23andMe. For a fuller account of the bankruptcy and what it meant for the case, see our 23andMe bankruptcy explainer.

The class action lawsuits claimed that 23andMe failed to adequately protect customer information. 23andMe denied any wrongdoing, and no court decided who was right. The parties reached a settlement, which the Bankruptcy Court granted final approval on January 30, 2026. Important: the claim deadline of February 17, 2026 has passed, so this settlement is now closed and no new claims can be filed.

The $46.75 Million Distribution (June 2026 Update)

The settlement was approved with a cap of $50 million. In a June 2026 filing, the plan administrator set the actual distribution at $46.75 million — $3.25 million below the cap. Of that amount, about $32.5 million is allotted to resolve the consolidated class-action claims, and more than $14 million is being used to pay the settlement and claims administrator, Kroll.

According to the official settlement website, settlement payments will not be distributed until the bankruptcy reconciliation process is resolved, which may take several months or longer. Class members should watch the official settlement website for payment timing. The deadline to submit a Deficiency Cure Form (to fix a claim flagged as deficient) is June 12, 2026.

Who Qualified?

You were in the settlement class if all of the following were true: you were a 23andMe customer at any time between May 1, 2023 and October 1, 2023; you lived in the United States during that period; and you received notice from 23andMe that your personal information was compromised in the October 2023 cyber security incident.

You were in a separate statutory subclass if you were a resident of Alaska, California, Illinois, or Oregon during that period and also received a breach notice. You may also have been eligible for a Health Information Claim if your notice stated that your health-related information — such as uninterpreted raw genotype data, certain health reports, or self-reported health condition information — was accessed.

How Much Could You Get?

Eligible class members could receive a combination of the following benefits, funded from the settlement:

Privacy & Medical Shield plus Genetic Monitoring: five years of monitoring (web and dark-web monitoring, identity-theft protection, and up to $1 million in identity-theft insurance) for all class members who enroll. The notice estimated a retail value of about $1,875.

Extraordinary Claims — up to $10,000: reimbursement for documented, unreimbursed out-of-pocket costs directly related to the incident, from an Extraordinary Claims Fund capped at $8.3 million. Documentation was required, and payments are reduced pro rata if valid claims exceed the fund.

Health Information Claims — up to $165: for people whose notice said their health information was accessed, from a fund of up to $1,250,000.

Statutory Cash Claims — about $100: for eligible residents of Alaska, California, Illinois, and Oregon, paid pro rata from the remaining net fund. The final amount could be higher or lower depending on the number of valid claims.

Because the final distribution of $46.75 million came in below the $50 million cap, some benefit amounts may be reduced proportionally from the maximums above.

Did You Need Proof to File?

Yes. The online claim form required a Class Member ID — a unique number issued by the settlement administrator and printed in the mailed or emailed breach notice — so this settlement was proof-required even for the cash tiers. A claimant who never received a notice could not simply file without that identifier. Extraordinary Claims for up to $10,000 additionally required documentation (such as bank statements or receipts) showing unreimbursed costs tied to the breach.

If you filed a claim but it was flagged as deficient, the deadline to submit a Deficiency Cure Form is June 12, 2026. For questions about a Class Member ID or a deficient claim, use the contact form on the official settlement website.

Key Dates

Opt-Out / Objection Deadline: December 29, 2025 (passed)

Final Approval Hearing: January 20, 2026

Final Approval Granted: January 30, 2026

Claim Deadline: February 17, 2026 (passed)

Deficiency Cure Form Deadline: June 12, 2026

Frequently Asked Questions

Is the 23andMe data breach settlement still open?

No. The Court granted final approval on January 30, 2026 and the claim deadline of February 17, 2026 has passed, so no new claims can be filed. The deadline to submit a Deficiency Cure Form is June 12, 2026.

How much is the 23andMe data breach settlement?

The settlement was capped at $50 million. In June 2026 the plan administrator set the actual distribution at $46.75 million — about $32.5 million to resolve the class claims and more than $14 million to administrator Kroll. Individual cash payments ranged from about $100 up to $10,000 for documented Extraordinary Claims, plus five years of genetic monitoring.

When will 23andMe settlement payments be sent?

According to the official settlement website, payments will not be distributed until the bankruptcy reconciliation process is resolved, which may take several months or longer. Check the official settlement website for payment updates.

Did the 23andMe settlement require proof?

Yes. The online claim form required a Class Member ID from the mailed or emailed notice, so the settlement was proof-required. Extraordinary Claims for up to $10,000 also required documentation of unreimbursed, breach-related costs.


Official Settlement Notice

Your browser does not support viewing PDFs inline. Download the PDF.


Sources



For more class actions keep scrolling below.
Settlement Amount $46.75 million distribution (capped at $50 million)
Case Title In re Chrome Holding Co., et al. (f/k/a 23andMe Holding Co. and 23andMe, Inc.)
Case Number 25-40976-357
Court U.S. Bankruptcy Court, Eastern District of Missouri
Final Approval Granted January 30, 2026 Hearing held January 20, 2026; $46.75M distribution set June 2026
Administrator Kroll Settlement Administration LLC
Status Closed — claim deadline February 17, 2026 has passed; payments pending bankruptcy reconciliation
Official Website 23andMe Data Settlement.com

More on Data Breach & Privacy Settlements