Reprinted from Eastman’s On-line Genealogy Newsletter, May 13th 2025
Claims are now open for individuals impacted by DNA-tracking company 23andMe’s 2023 data breach, and we’ve got all the details about how to opt in and how much you might be able to get paid.
The San Francisco-based company, which allows people to submit genetic materials and get a snapshot of their ancestry, announced in October 2023 that hackers had accessed customer information in a data breach, but the company didn’t confirm the full extent of the incident until December. Around half of the company’s 14 million people saw their personal information exposed in the leak, which first began in April 2023.
The lawsuit, filed in January 2024, accused 23andMe of not doing enough to protect its customers. It also accused 23andMe of not notifying certain customers with Chinese or Ashkenazi Jewish ancestry that their data was targeted specifically and spread on the dark web. The company opted to settle the suit for $30 million.
“We have executed a settlement agreement for an aggregate cash payment of $30 million to settle all US claims regarding the 2023 credential stuffing security incident,” a 23andMe spokesman told CNET. “We continue to believe this settlement is in the best interest of 23andMe customers, and we look forward to finalizing the agreement.”
Now, a few months on, there’s finally an official method available for you to make your claim and potentially get paid by 23andMe, in some cases as much as $10,000. Keep reading to get all the details you need, and for more, find out why T-Mobile settlement checks have been delayed and see if you’re able to claim a piece of Apple’s Siri privacy settlement.
How many people were affected by the 23andMe data breach?
The settlement could cover roughly 6.9 million 23andMe customers whose data was targeted in the leak. To qualify for the proposed settlement, 23andMe users must also have been a US resident on Aug. 11, 2023.
That 6.9 million number includes around 5.5 million users of 23andMe’s DNA Relatives profiles, which lets users find and connect with genetic relatives. The other 1.4 million people affected by the breach used another service known as Family Tree, which predicts a family tree based on the DNA users share with relatives, 23andMe said.
How much money could you get as part of the 23andMe settlement?
At the top end, 23andMe has said that it will pay out up to $10,000 with an “Extraordinary Claim” to users who can verify that they suffered hardships as a direct result of their information being stolen in the data breach that resulted in unreimbursed costs. This includes costs resulting from “identity fraud or falsified tax returns,” from acquiring physical security systems, or from receiving mental health treatment.
Residents of Alaska, California, Illinois and Oregon who were impacted by the breach can also apply for a payment as part of the proposed settlement, since those states have genetic privacy laws with damages provisions. The payments for these individuals are expected to be around $100, depending on how many people file for them, a settlement document said.
Also, a smaller subset of affected users whose personal health information was impacted by the breach will be able to apply for a payment of $100.
Infographic credit: Gianmarco Chumbe/CNET; Background image: Jason Doiy/Getty Images
Will the settlement include anything else?
Beyond those payments, 23andMe will also offer impacted users three years of a security monitoring service called Privacy Shield, which filings described as providing “substantial web and dark web monitoring.”
How can I apply for the 23andMe settlement?
In order to file a claim electronically, you can do so using this official online portal from the Kroll Restructuring Administration. An additional online form is available if you would like proof of your claim sent to you.
Potential claimants can also download and print out hard copies of the claim form and proof of claim form if they wish to submit them by mail. If you’re planning to use this method, send your forms to one of the addresses listed on the official claims website. The deadline to make your claim is July 14.
