23 and Me Lawsuit Data Breach Settlement Claims Update 2026
The 23 and me lawsuit became a major privacy case after hackers accessed sensitive customer information in 2023. The incident raised serious concerns because 23andMe stores personal, ancestry, and genetic-related information about its users.
The legal dispute later grew into a large class-action case involving millions of affected customers across the United States. In 2026, a court approved a $46.75 million settlement to resolve claims connected with the breach.
What Is the 23 and Me Lawsuit About?
The 23 and me lawsuit mainly relates to a cyberattack that 23andMe announced on October 6, 2023. Hackers gained access to customer information after breaking into some user accounts and accessing connected profile information.
The official settlement administrator says the incident affected information linked to about 6.4 million U.S. residents. Meanwhile, state attorneys general reported that the broader breach affected about 6.9 million consumers worldwide.
How Did the 23andMe Data Breach Happen?
The attack involved stolen login credentials that hackers could use to enter certain customer accounts. State investigators later criticized the company’s safeguards against attacks that use previously stolen usernames and passwords.
Investigators also identified concerns about login monitoring, rate limits, security controls, and tools used to detect unusual activity. These findings became important parts of later government actions against the company.
What Information Was Exposed?
The 23 and me lawsuit attracted attention because the stolen records included highly personal information. According to state authorities, some affected records included genetic ancestry information and other customer details.
Authorities also reported that parts of the stolen information later appeared for sale on the dark web. This development increased concerns about privacy, identity theft, and the long-term risks of stolen personal information.
How Many People Were Affected?
The official class-action settlement website states that about 6.4 million U.S. residents had information involved in the cyberattack. The settlement class focuses on eligible customers who lived in the United States during the covered period.
Government investigations use a broader figure of around 6.9 million consumers affected by the 2023 breach worldwide. This difference mainly reflects the groups covered by different legal proceedings.
23 and Me Lawsuit Settlement Amount
The 23 and me lawsuit reached an important point when the bankruptcy court approved the class settlement. Final approval was granted on January 30, 2026, according to the official settlement website.
Later, on July 7, 2026, the court approved a final settlement amount of $46.75 million. The settlement administrator expects eligible class member payments to begin in September 2026.
The settlement does not mean that every class member will receive the same amount. Payment depends on the type of approved claim, documentation, eligibility, and other settlement rules.
| Settlement Detail | Information |
|---|---|
| Main incident | 2023 23andMe cyberattack |
| U.S. residents involved | About 6.4 million |
| Broader affected population | About 6.9 million consumers |
| Final class settlement | $46.75 million |
| Final approval | January 30, 2026 |
| Final amount approved | July 7, 2026 |
| Claim deadline | February 17, 2026 |
| Expected payments | September 2026 |
How Much Money Could Customers Receive?
Eligible people who submitted valid claims may qualify for different types of settlement benefits. The official settlement information lists several payment categories depending on a person’s circumstances.
Extraordinary claims may provide payments of up to $10,000, while qualifying health information claims may provide up to $165. The settlement also listed an estimated $100 statutory cash payment for certain eligible claims.
Who Qualified for the Settlement?
Under the 23 and me lawsuit settlement rules, a person generally needed to meet several requirements. The individual had to be a 23andMe customer during the covered period and live in the United States.
The official settlement defines eligible class members as customers between May 1, 2023 and October 1, 2023 who lived in the United States. They must also have received notice that 23andMe believed their personal information was compromised.
Is the Claim Deadline Still Open?
The deadline to submit a claim was February 17, 2026. Therefore, the normal claim filing period has already ended as of August 2026.
The deadline to object to or opt out of the settlement was December 29, 2025. A separate deficiency cure deadline for certain claim problems was June 12, 2026.
23andMe Bankruptcy
The 23 and me lawsuit developed alongside serious financial problems at the company. 23andMe filed for bankruptcy protection in March 2025, which affected how legal claims and settlement money could be handled.
State attorneys general also pursued separate claims connected with the breach. In July 2026, a coalition secured $18 million in immediate recovery from available bankruptcy funds as part of a broader settlement of state claims.
New Privacy and Security Requirements
The legal actions did more than seek financial payments. Authorities also pushed for stronger security standards for customer genetic information.
After bankruptcy proceedings, customer data was transferred to TTAM Research Institute, which is connected with 23andMe founder Anne Wojcicki. Authorities said new requirements include security risk analysis, an advisory board, and continued customer data deletion rights.
Why This Lawsuit Matters for Genetic Privacy
The 23 and me lawsuit shows why companies must treat DNA-related information with special care. Consumers often provide genetic testing companies with information that can reveal ancestry and family connections.
Unlike passwords, customers cannot replace their genetic information after hackers steal it. Therefore, strong passwords, two-factor authentication, monitoring systems, and careful data management remain important protections.
Final Thoughts
The 23 and me lawsuit became an important example of the risks connected with storing genetic and personal data online. The 2023 breach affected millions of customers and eventually led to class-action claims, government investigations, bankruptcy proceedings, and new privacy requirements.
The court has approved a $46.75 million consumer settlement, while separate state actions produced additional legal and financial consequences.
