A federal judge approved a $47 million settlement for victims of 23andMe's 2023 data breach, resolving a class-action lawsuit against the genetic testing company. The payout compensates users whose sensitive DNA profiles and personal health information were exposed when hackers gained unauthorized access to customer accounts.
The breach affected millions of 23andMe users who had opted into the company's DNA Relatives feature. Attackers used credential stuffing techniques, exploiting passwords from other data breaches to access 23andMe accounts. The company initially downplayed the incident before acknowledging the full scope of the compromised data, which included genetic ancestry information, health predispositions, and names connected to DNA profiles.
The settlement allows affected customers to claim compensation without proving individual damages. Eligible victims can receive money through a claims process, though the exact payout per person depends on total claim volume. 23andMe did not admit wrongdoing as part of the agreement.
The judge's approval marks a significant moment for data privacy enforcement in the biotechnology sector. 23andMe operates one of the largest genetic databases in the world, making the breach a watershed event for consumer trust in DNA testing services. The company faced intense backlash from privacy advocates and regulators, including investigations by state attorneys general and the Federal Trade Commission.
23andMe has implemented enhanced security measures since the incident, including mandatory password updates and two-factor authentication. The settlement reflects growing accountability for companies handling sensitive genetic data, an increasingly valuable commodity in healthcare research and personalized medicine.
For 23andMe users, the payout offers some recourse, though critics argue the financial penalty remains modest compared to the company's market value and the sensitive nature of genetic information. The case underscores the stakes of data security for companies operating at the intersection of consumer genetics and health tech.