23andMe data breach: Settlement could pay $10,000 to data breach victims

After a data breach exposed the personal information of about half of its user base and led to growing distrust of the popular ancestry service, 23andMe confirmed last month that it will settle a class-action lawsuit of $30 million accusing it of not protecting users enough.

The San Francisco-based company, which allows users to submit genetic materials and get a snapshot of their ancestry, announced in October 2023 that hackers had accessed customer information in a data breach, but the company did not confirm the full extent of the incident. until December About half of the company’s 14 million users saw their personal information exposed in the leak, which began in April 2023.

The lawsuit accusing the company of not doing enough to protect its customers was filed in January of this year. The lawsuit also accused 23andMe of failing to notify certain customers with Chinese or Ashkenazi Jewish ancestry that their data was specifically targeted and spread on the dark web. As part of the proposed settlement, which still requires preliminary court approval, the company will offer up to $10,000 to qualifying customers, depending on the hardship they have suffered, as well as other services safety In the wake of that ordeal, independent directors on the company’s board resigned, and concerns about 23andMe’s ability to retain your personal data became a trending topic.

“We have entered into a settlement agreement for a total cash payment of $30 million to resolve all US claims related to the 2023 credential stuffing security incident,” a 23andMe spokesperson told CNET . “We continue to believe this settlement is in the best interest of 23andMe’s customers and look forward to closing the deal.”

Here’s what we know about the terms of the 23andMe data settlement. To learn more about recent settlements, read how you can claim money from CashApp and who’s eligible for an estate agent commission settlement.

How many people were affected by the 23andMe data breach?

The settlement will cover approximately 6.9 million 23andMe users whose data was targeted in the breach. To be eligible for the proposed settlement, 23andMe users must also have been US residents on August 11, 2023.

That 6.9 million number includes about 5.5 million users of 23andMe’s DNA Relatives profiles, which allow users to find and connect with genetic relatives. The other 1.4 million people affected by the breach used another service known as Family Tree, which predicts a family tree based on the DNA users share with family members, 23andMe said.

How much money could you get as part of the settlement?

At the high end, 23andMe has said it will pay up to $10,000 in an “extraordinary claim” to users who can verify they suffered hardship as a direct result of their information being stolen in the data breach that resulted in undisclosed costs. reimbursed This includes costs resulting from “identity fraud or falsified tax returns,” purchasing physical security systems, or receiving mental health treatment.

Residents of Alaska, California, Illinois and Oregon who were affected by the breach may also seek payment as part of the proposed settlement, as those states have genetic privacy laws with damages provisions. Payments for those people are expected to be around $100, depending on how many people apply, according to a settlement document.

Additionally, a smaller subset of affected users whose personal health information was affected by the breach will be eligible to request a $100 payment.

Infographic credit: Gianmarco Chumbe/CNET; Background image: Jason Doiy/Getty Images

Will the settlement include anything else?

Beyond those payments, 23andMe will also offer affected users three years of a security monitoring service called Privacy Shield, which the documents describe as “substantial web and dark web monitoring.”

Can you request settlement yet?

There is currently no way to request payment as part of this proposed settlement. CNET will provide updates on this aspect of the story as they become available.

For more information, read this explainer on how class action lawsuits work.