Full Breakdown
23andMe Data Breach Settlement Approved Amid Ongoing Legal Scrutiny
7/8/2026, 11:45:31 AM
Settlement Approved for 2023 23andMe Breach Victims
A St. Louis bankruptcy judge approved a $46.75 million settlement for 2023 23andMe breach victims. The court directed Kroll Restructuring to distribute the funds, adding $32.46 million to the $14.29 million already paid.
Background: 2023 Breach and Bankruptcy
Hackers accessed about 14,000 accounts in 2023, exposing genetic and personal data of roughly 6.9 million 23andMe users—about half its base. The breach triggered investigations, a £2.31 million ICO fine, and a March 2025 bankruptcy filing. Later, Chrome Holding, a nonprofit led by co-founder Anne Wojcicki, bought the assets for $305 million under the TTAM Research Institute name.
Key Figures & Groups
The settlement involves Chrome Holding (operating as the TTAM Research Institute) led by co-founder Anne Wojcicki, the bankruptcy administrator Kroll Restructuring, California Attorney General Rob Bonta, the UK Information Commissioner’s Office, and the St. Louis bankruptcy court overseeing the case.
Data & Financial Figures
The breach affected roughly 6.9 million users, with 14,000 accounts directly accessed. The settlement totals $46.75 million—$14.29 million already paid and $32.46 million remaining. Chrome Holding acquired the assets for $305 million; the ICO imposed a £2.31 million fine, and the company was once valued at $6 billion, never having turned a profit.
Why It Matters
The settlement highlights growing regulatory scrutiny of consumer genetic data and the financial risk for firms that fail to protect health information, raising doubts about the future of 23andMe’s online DNA testing service under tighter oversight.
Official Statements & Responses
California AG Rob Bonta alleges Chrome Holding failed to implement basic data-protection steps and misrepresented the breach’s severity. Chrome Holding has asked the bankruptcy court to block the AG’s civil suit; a ruling is pending. The ICO’s fine reflects its view that 23andMe lacked adequate security controls before the breach.
Criticism & Opposition
Consumer advocates and regulators criticize 23andMe for exposing users and their relatives’ genetic profiles, saying the firm ignored known system vulnerabilities. The AG’s lawsuit accuses the company of lying about the breach’s scope, prompting calls for stronger industry standards.
Conflicting Reports & Gaps
Sources differ on breach scope: one cites 14,000 compromised accounts, another notes those accounts gave hackers access to millions of related profiles. The number of claimants receiving payments is undisclosed. The settlement figure shifted from an earlier $30-$50 million estimate to $46.75 million without public explanation.
Verbatim Quotes
- “failed to take basic steps to protect users' data.” — Rob Bonta, California Attorney General
- “lied to consumers about the severity of its 2023 data breach.” — Rob Bonta, California Attorney General
- “The ICO said 23andMe had failed to put adequate measures in place to secure sensitive user data prior to the incident.” — Information Commissioner’s Office
- “comprehensive” genetic profiles of people who submitted their DNA, including genetic markers related to their health and family history. — BBC report
What’s Next
The bankruptcy court will review Chrome Holding’s request to block the California AG’s suit. Kroll Restructuring will begin disbursing the remaining $32.46 million. U.S. and U.K. regulators remain monitoring compliance, and additional civil penalties may follow pending investigations.
