23andMe victims to share $46.75m payout after data breach exposed millions of genetic profiles

Victims of a 2023 data breach at genetics testing company 23andMe are set to receive a $46.75m (£35m) payout after a California bankruptcy court judge ruled on Tuesday that Chrome Holding, which took control of the company last year, must pay the sum in compensation. Chrome Holding – operated by 23andMe co-founder Anne Wojcicki under the name TTAM Research Institute – acquired the company’s assets for $305m after 23andMe filed for bankruptcy early last year, about 18 months after hackers accessed roughly 14,000 user accounts. While that number represented a small fraction of 23andMe’s total users, the hackers were able to access the profiles of those users’ relatives, giving them access to millions of profiles – 6.9 million people had their data breached. The settlement will be paid to Kroll Restructuring, which represents the victims, within five business days from Tuesday, according to the ruling. Kroll will then distribute the funds. The BBC has contacted the legal team to ask how many people will receive the payout. 23andMe, which compiles genetic profiles through DNA testing kits, was heavily criticised after the hack exposed highly personal information, including genetic markers related to health and family history. The breach triggered investigations and fines: the UK’s Information Commissioner’s Office issued a £2.31m fine, saying 23andMe had failed to put adequate measures in place. In May, California Attorney General Rob Bonta sued the company, claiming it “failed to take basic steps to protect users’ data” and “lied to consumers about the severity of the data breach.” 23andMe, which started in 2006 and went public in 2021, was once valued at $6bn but has never turned a profit. It continues to operate, still offering DNA testing kits online.