23andMe’s $30 Million Data Breach Settlement

If you were affected by the recent 23andMe data breach, you may be entitled to compensation in a $30 million settlement. Here you will find an overview of the payouts and how you can make a claim.

In October 2023, 23andMe announced that around 14,000 customer accounts had been accessed without authorization. The attackers used a method called “credential stuffing,” using credentials stolen from other platforms to infiltrate 23andMe accounts.

The hacker attack exposed the personal data of millions of customers. Names, birth years, ancestry information, and data shared through the DNA Relatives feature remained open to the public and malicious acts. The company insisted that its systems were not directly compromised, but that meant nothing to the customers who had entrusted the company with such sensitive and private information.

Compensation for affected customers

The settlement provides for three categories of compensation, with a maximum individual award of up to $10,000 for certain claims:

• Extraordinary demands: Customers who have suffered major harm, such as identity theft or security costs, can request compensation of up to $10,000. To qualify, you must provide documentation such as receipts or records of associated costs. This category has a total cap of $5 million, meaning payouts could be reduced if total claims exceed this limit.
• Health Information Disclosures: Customers whose sensitive health information was exposed during the breach are entitled to a payout of approximately $100. This category applies to compromised health-related information and has an aggregate cap of $750,000 for all applicants.
• Legal monetary claims: Residents of California, Illinois, Oregon and Alaska who have received violation notices may seek general compensation expected to be approximately $100. Applicants must confirm their residency in one of these states.

Final payout amounts may vary depending on the size of claims submitted and the total funds available in the settlement. If demand is high, the remuneration will be distributed proportionately.

How to file a claim

Once the official 23andMe arbitration website is launched, you can submit your claim there. For those who prefer to submit their claims by mail, the website provides both an online claim form and a downloadable PDF version.

When making a claim, be sure to include any necessary supporting documentation, such as receipts or expense reports. Once your form is complete, you can mail it to the following address:

23andMe billing manager
PO Box 301172
Los Angeles, CA 90030-1172

Make sure you file your claim before the deadline. Although the exact date has not yet been published, it will be announced once the settlement has been finally approved by the court.

Additional benefits for those affected

Customers affected by the breach will also receive three years of security monitoring services. These services help detect identity theft and other security risks associated with the exposed data.

Filing a lawsuit provides data subjects with the opportunity to obtain compensation for the unauthorized use of their personal information.

Timeline of 23andMe Data Breach

April 29 – September 27, 2023: During this period, unauthorized access to around 14,000 23andMe customer accounts occurred. The attackers used a “credential stuffing” technique, where they used login credentials obtained from other breaches to access 23andMe accounts.

October 2023: 23andMe publicly disclosed the data breach, revealing that sensitive personal information, including names, birth years and ancestry dates, had been exposed.

December 2023: The company acknowledged that the breach affected about 6.9 million users, almost half of its customer base at the time.

January 2024: Affected customers filed a class action lawsuit against 23andMe in a San Francisco court, claiming their privacy was not protected.

September 13, 2024: 23andMe agreed to a $30 million settlement to resolve the lawsuit, which includes cash payments to affected customers and three years of security monitoring services.

October 17, 2024: The settlement is awaiting final court approval. Details of claims submission processes and deadlines will be provided upon approval. However, there are no public updates confirming whether the court granted final approval as of November 21, 2024.