Truth. Clarity. Insight.
A judge has ordered 23andMe to pay $47 million to victims of its 2023 data breach, highlighting the severe implications of compromised genetic data. This ruling underscores the critical need for robust data security in the direct-to-consumer genetic testing industry.
Victims of the 2023 23andMe cyberattack are set to receive compensation after a California bankruptcy judge approved a $46.75 million settlement.
The ruling requires Chrome Holding, the company that assumed control of 23andMe during bankruptcy proceedings, to fund the settlement for individuals whose personal information was compromised in one of the largest genetic data breaches in recent years.
The decision marks another major development in the ongoing legal fallout surrounding the cybersecurity incident that affected millions of customers.
In 2023, hackers gained unauthorized access to approximately 14,000 customer accounts on 23andMe.
Although the number of directly compromised accounts appeared relatively small, attackers were able to use the company's DNA Relatives feature to access information linked to users' family members.
As a result, personal and genetic data belonging to approximately 6.9 million individuals was exposed.
The breach included highly sensitive information such as:
The incident sparked widespread privacy concerns because genetic information is permanent and uniquely identifies individuals.
According to the court order, the settlement funds will first be transferred to Kroll Restructuring, the firm responsible for administering claims on behalf of affected individuals.
Kroll will then distribute compensation to eligible victims.
The exact number of people who will receive payments has not yet been publicly confirmed.
23andMe filed for bankruptcy protection after facing financial challenges and mounting legal liabilities following the cyberattack.
During the bankruptcy process:
Despite the ownership changes, the company continues selling DNA testing kits and genetic services.
Following investigations into the breach, regulators concluded that 23andMe failed to adequately protect sensitive customer data.
The UK Information Commissioner's Office (ICO) imposed a £2.31 million fine, stating that the company had not implemented sufficient cybersecurity measures before the attack.
Regulators emphasized that organizations handling sensitive genetic information must maintain stronger safeguards against unauthorized access.
In addition to the settlement, California Attorney General Rob Bonta filed a lawsuit against the company after an investigation into the incident.
The lawsuit alleges that:
The legal proceedings remain separate from the court-approved settlement.
Unlike passwords or payment cards, genetic information cannot be changed once it has been exposed.
DNA data may reveal information about:
Because family members often share portions of their DNA, a breach involving one person's account can potentially expose information relating to relatives as well.
This makes genetic data among the most sensitive categories of personal information.
Founded in 2006, 23andMe became one of the world's best-known consumer genetic testing companies.
The company went public in 2021 and at one point reached a market valuation of approximately $6 billion.
Despite its popularity, the business struggled to achieve profitability and eventually entered bankruptcy proceedings while continuing to operate its DNA testing services.
Following the court's approval:
The settlement represents one of the largest financial recoveries involving a consumer genetic data breach.
The payout stems from a 2023 cyberattack on 23andMe, where sensitive genetic profiles and personal information of users were compromised. This class-action settlement aims to compensate victims for the exposure of their highly personal and immutable genetic data, highlighting the company's accountability for inadequate data security measures.
23andMe collects genetic profiles through DNA testing kits, which reveal ancestry, health predispositions, and family connections. This data is uniquely sensitive because it's immutable, deeply personal, and can have implications for an individual's relatives, making its compromise far more impactful than other data types.
Unlike credit card numbers or passwords, genetic data cannot be changed or reissued. It's a permanent identifier that can reveal predispositions to diseases, physical traits, and family relationships, leading to potential discrimination in areas like employment or insurance, and posing long-term risks that are difficult to mitigate.
This ruling sets a significant precedent for the entire direct-to-consumer genetic testing industry and other companies handling sensitive personal data. It underscores the severe financial and reputational liabilities associated with data breaches, compelling companies to invest more heavily in cybersecurity and transparent data protection practices to maintain consumer trust.
Consumers should thoroughly research a company's privacy policies and security track record before submitting genetic data. It's crucial to understand how data will be stored, used, and shared. Regularly reviewing privacy settings and being aware of the long-term implications of sharing immutable genetic information are also vital protective measures.
While this specific settlement is a judicial outcome, it contributes to the ongoing global conversation about data privacy, especially for genetic information. It reinforces the need for robust regulatory frameworks like GDPR and CCPA and may prompt policymakers to consider even stricter legislation or enforcement actions to better protect highly sensitive genomic data in the future.
Canada and the United States say they are close to finalising a new trade agreement after days of intense negotiations. The proposed deal could reduce US tariffs on Canadian steel, aluminium and vehicles while giving American producers greater access to parts of Canada's market. Both governments say the agreement could provide greater certainty for businesses and strengthen North American trade.
Vivien Wong left an £80,000-a-year accounting job at 28 to build Little Moons, the mochi ice cream company she founded with her brother Howard. The brand eventually became a viral sensation, but its success was built over more than a decade. Wong says entrepreneurs should launch before everything is perfect, understand their brand, accept sacrifices, set boundaries with family, and remember that overnight success usually takes years of preparation.
A leading UK think tank has warned that Prime Minister Andy Burnham has little room to increase government borrowing while funding new cost-of-living measures and higher defence spending. According to NIESR, the government may eventually need to raise taxes, reform the tax system, or cut spending elsewhere to keep public finances stable. The institute also expects UK inflation to remain elevated until early 2027, with interest rate cuts potentially delayed until 2028, increasing pressure on both households and the government's budget.