In a landmark resolution to litigation stemming from its devastating 2023 data breach, the bankruptcy estate of former genetics-testing giant 23andMe—now operating as Chrome Holding Co.—has agreed to a $46.75 million settlement to compensate affected customers. The deal, approved by the U.S. Bankruptcy Court for the Eastern District of Missouri, resolves consolidated class-action lawsuits filed after the breach was disclosed in October 2023.
The breach, which began around April 2023 and persisted for approximately five months, compromised sensitive genetic and personal data of nearly 6.9 million users—nearly half of 23andMe’s 14.1 million customer base at the time. Hackers accessed 5.5 million DNA Relatives profiles (used for connecting with genetic matches) and data from 1.4 million customers who utilized the Family Tree feature.
Under the settlement framework, $32.5 million is allocated to resolve class claims, while nearly $14.3 million has already been disbursed to Kroll—the court-appointed settlement administrator. Notably, about $13 million of that sum came from cyber insurance policies issued by Allied World Specialty Insurance Company, Houston Casualty Company (a Tokio Marine HCC affiliate), Landmark American Insurance Company (a Berkshire Hathaway entity), and Lloyd’s underwriters—a rare public glimpse into how cyber insurance helped absorb a major biotech breach.
The final payout represents a $3.25 million reduction from the originally proposed $48 million cap set in the January 2026 settlement agreement. In court filings, the judge emphasized that pursuing the full amount would trigger “protracted, high-stakes litigation lasting months, if not years,” costing millions more in legal fees—resources the court deemed better preserved “for the benefit of stakeholders.”
As of the June 10 filing, over 255,860 claims have been resolved—but “thousands remain unresolved,” including determinations on claim eligibility and value. Payouts are not flat-rate; instead, they range from $50 for standard claims up to $10,000 for extraordinary cases involving demonstrable harm or identity theft.
The settlement arrives amid broader corporate upheaval: 23andMe filed for Chapter 11 bankruptcy in March 2025, sold off key assets, and was repurchased by co-founder Anne Wojcicki. Though California attempted to block the sale, it failed—and late last month, the state sued Chrome Holding Co., alleging systemic failures in safeguarding consumers’ genetic data.
This case underscores growing regulatory scrutiny—and financial accountability—for companies handling highly sensitive biometric information in an era of escalating cyber threats.
Source: U.S. Bankruptcy Court for the Eastern District of Missouri, Case No. 25-40554 (June 10, 2025 filing)
Source: https://www.insurancejournal.com/news/national/2026/06/12/873539.htm
Leave a Reply