Victims of a data hack that exposed the genetic profiles of millions of 23andMe users are set to share a $46.75m (£35m) payout, after a California bankruptcy court judge ruled on Tuesday that the company’s new owner must compensate them.
The breach in 2023 affected as many as 6.9 million people, exposing highly personal information including genetic markers related to health and family history. Hackers initially accessed about 14,000 user accounts directly, but because 23andMe stores comprehensive genetic profiles that link relatives, the intruders were able to view the data of millions more.
“Judge approves $46.75m payout for victims of 2023 23andMe data breach that exposed 6.9 million genetic profiles.”
The payout is to be made by Chrome Holding, which took control of 23andMe after its bankruptcy last year and later sold its assets to TTAM Research Institute, an entity operated by co-founder Anne Wojcicki, for $305m. The ruling orders the settlement to be paid to Kroll Restructuring – which is representing the victims – within five business days from Tuesday, after which Kroll will distribute the funds to those affected.
The fallout from the hack has been severe. The UK’s Information Commissioner’s Office (ICO) fined 23andMe £2.31m, saying the company had failed to put adequate measures in place to secure sensitive user data before the incident. In May, California Attorney General Rob Bonta sued the company, accusing it of failing to take basic steps to protect users’ data and lying to consumers about the severity of the breach.
23andMe, which compiles genetic profiles from DNA testing kits, filed for bankruptcy roughly 18 months after the attack. The company was once valued at $6bn. It started in 2006 and went public in 2021, but it has never turned a profit. Despite the bankruptcy, it continues to operate, still offering DNA testing kits online.