Victims of the 2023 data hack at genetics testing company 23andMe are set to receive a multi-million payout after a California bankruptcy court judge ruled on Tuesday that Chrome Holding – the entity that took control of 23andMe after its bankruptcy – should pay $46.75m (£35m) in compensation.
The ruling comes after as many as 6.9 million people had their data breached in the 2023 hack. Hackers initially accessed roughly 14,000 user accounts, but because 23andMe offered comprehensive genetic profiles – including genetic markers related to health and family history – and allowed them to link to relatives, the breach exposed millions of profiles. The company was heavily criticised for failing to secure sensitive user data.
“Judge orders $46.75m payout to victims of 2023 23andMe data breach affecting 6.9 million people”
23andMe early last year filed for bankruptcy, about 18 months after the hack. Last year, Chrome Holding sold 23andMe’s assets to TTAM Research Institute, an entity operated by co-founder Anne Wojcicki, who won the assets through a bankruptcy auction with a bid of $305m.
The judge’s ruling stated that the settlement will first be paid to Kroll Restructuring – which is representing the victims – within five business days from Tuesday. Kroll will then distribute the funds to the victims. The appointment of companies like Kroll is typical in corporate bankruptcy proceedings. The BBC has contacted the legal team representing the victims to ask how many people will receive the payout.
The breach led to investigations and fines, including a £2.31m fine by the Information Commissioner’s Office (ICO), a UK watchdog. The ICO said 23andMe had failed to put adequate measures in place to secure sensitive user data prior to the incident. In May, Rob Bonta, the Attorney General of California, sued the company following an investigation that found 23andMe “failed to take basic steps to protect users’ data.” Bonta also claimed that 23andMe “lied to consumers about the severity of its 2023 data breach.”
Representatives of Chrome Holding and 23andMe have been contacted for comment. The company has continued to operate since the bankruptcy, offering DNA testing kits online. 23andMe was once valued at $6bn. It started in 2006 and went public in 2021, but it has never turned a profit. The payout, while substantial, leaves open the question of how many victims will actually see compensation – and whether it is enough to match the damage.