23andMe Class Action Lawsuit Settlement, $30M Payout Approved, What Eligible Customers Can Expect Next

The 23andMe data breach class action lawsuit settled for $30 million after a federal court approved the agreement on January 20, 2026. The settlement resolves a cyberattack announced by 23andMe on October 6, 2023, which resulted in the theft of personal information from approximately 6.4 million United States residents. The February 17, 2026 claim deadline has now passed, but eligible class members who filed in time are waiting on payment distribution — a process that may take several months due to 23andMe’s ongoing bankruptcy proceedings.

Quick Facts

SERP Analysis: What People Are Searching For

Before writing this article, we analyzed what U.S. consumers are actively searching for on this topic. The top search intents around “23andMe class action lawsuit payout” fall into four categories:

1. Payout amount and eligibility — Searchers want to know how much they can receive, what documentation is needed, and whether they qualify based on the type of data exposed.

2. Payment timeline — The most urgent current question: when will the money actually arrive? Given the bankruptcy complication, this is the single most important unanswered question for class members who filed claims.

3. Post-deadline options — Many searchers missed the February 17 deadline and want to know if they can still participate or what they are entitled to.

4. Genetic data concerns — A subset of searchers are worried specifically about who now owns their DNA data following the bankruptcy sale, and how the settlement addresses ongoing data privacy.

This article addresses all four directly.

Background: What Happened at 23andMe

The October 2023 Cyberattack

On October 3, 2023, hackers used credential stuffing tactics to access 23andMe customer accounts. Attackers used stolen usernames and passwords from other websites to break into 23andMe profiles, exposing sensitive information of approximately 6.4 million United States residents who used the genetic testing service between May 1 and October 1, 2023.

The class action lawsuit subsequently filed against 23andMe accused the site of failing to protect users. The lawsuit also alleged that much of the stolen data belonged to Jewish and Chinese users, possibly in a targeted attack.

The exposed data was not limited to names and email addresses. Personal information compromised in the breach included genetic and ancestry information, health predisposition reports, wellness reports, carrier status reports, raw genotype data, and self-reported health condition information for certain users.

The Lawsuits and Consolidation

23andMe agreed to pay a “carefully tailored” $30 million settlement to resolve more than 40 class action lawsuits filed in the wake of the massive data breach.

On April 11, 2024, the various actions were consolidated in the United States District Court for the Northern District of California before The Honorable Edward M. Chen. Plaintiffs filed a Consolidated Class Action Complaint on June 26, 2024, and a motion for preliminary approval of a proposed class action settlement on September 12, 2024.

Bankruptcy Complicates the Path

23andMe subsequently filed for bankruptcy on March 23, 2025, in the Eastern District of Missouri. This moved the settlement process into bankruptcy court, adding procedural complexity and extending the timeline.

On July 27, 2025, the Bankruptcy Court approved the sale of 23andMe’s assets to TTAM Research Institute. After the completion of the sale, 23andMe Holding Co. and 23andMe, Inc. formally changed their legal names to Chrome Holding Co. and ChromeCo, Inc., respectively. Despite the name change, the settlement obligation transferred to the new entity.

On September 4, 2025, plaintiffs and the debtors filed a joint motion for preliminary approval of a settlement in the bankruptcy proceedings. On October 2, 2025, U.S. Bankruptcy Judge Brian C. Walsh issued an order granting preliminary approval, appointing Kroll as the Settlement Administrator, and setting a final approval hearing for January 20, 2026.

The settlement received final court approval on January 30, 2026.

Related article: Bankruptcy Trustee Sues Erika Jayne for $25 Million Over Alleged Receipt of Stolen Client Funds, Fashion Designer Seeks $18 Million in Separate Malicious Prosecution Suit

Who Was Eligible to File a Claim

You are a Settlement Class Member if you (a) were a 23andMe customer at any time between May 1, 2023 through October 1, 2023; (b) resided in the U.S. during this time; and (c) received notice from 23andMe that your personal information was compromised.

Within the broader class, there were two additional subclasses with separate benefits:

Statutory Subclass: Class members residing in Alaska, California, Illinois, or Oregon are eligible to receive a one-time cash payment of approximately $100 due to genetic privacy laws in each state that outline provisions for statutory damages.

Health Information Subclass: If you received notice from 23andMe that your Health Information was involved in the Cyber Security Incident, you are eligible to receive a Health Information Claim payment. Your Health Information was accessed if the notice you received from 23andMe advises that your uninterpreted raw genotype data, certain health reports derived from the processing of your genetic information, or your self-reported health condition information was accessed.

Settlement Payout: How Much Can Eligible Class Members Receive?

The settlement offers four distinct tiers of compensation, with the amount depending on the type of data exposed and whether you can provide documentation.

Tier 1 — Extraordinary Out-of-Pocket Losses (Up to $10,000)

Those who submit with their claim form documented proof of extraordinary out-of-pocket losses are eligible to receive a one-time cash payment of up to $10,000.

Extraordinary claims reimburse documented, unreimbursed costs tied directly to the breach, including identity theft expenses, security systems purchased, and mental health costs related to the breach. Documentation required includes bank statements, fraud reports, receipts, or police reports showing unreimbursed costs directly traceable to the breach.

Tier 2 — Health Information Claims (Up to $165)

Those who were notified that their health information was impacted by the breach will receive $165, according to court documents. If you are eligible, settlement administrators say you need only provide your preferred payment method to receive payment — no additional documentation is required.

Tier 3 — Statutory Cash Claims (~$100)

Cash payments estimated at $100 are available for valid Statutory Cash Claims for Settlement Class Members who were residents of Alaska, California, Illinois, or Oregon at any time between May 1, 2023 and October 1, 2023. These amounts could increase or decrease based on the total number of valid claims submitted.

Tier 4 — Five Years of Free Privacy and Genetic Monitoring

All 23andMe settlement class members are eligible to enroll in five free years of Privacy and Medical Shield with Genetic Monitoring from CyEx, which provides identity theft protection, medical data monitoring, a virtual private network (VPN), password protection and dark web monitoring.

Even if a class member does not pre-enroll, they can still enroll at any time during the five-year service period. This benefit is available even to class members who did not file a cash claim before the February 17 deadline.

When Will Payments Be Distributed?

This is the most pressing question for class members who filed claims before the February 17, 2026 deadline — and the answer is complicated by the bankruptcy process.

According to the settlement administrators, payments won’t be disbursed until 23andMe’s bankruptcy reconciliation process is resolved. This “is likely to take considerable time,” the settlement site states.

Payment distribution is expected to begin approximately 60–90 days after final approval, assuming no appeals are filed. With final approval granted on January 30, 2026, and assuming no appeals, the earliest realistic distribution window begins in late April to May 2026 — but the bankruptcy reconciliation process may extend that timeline further.

Payments may take longer than a typical class action settlement because they must be processed through the bankruptcy court’s distribution procedures.

Payment method options: Class members will have the option to receive any payout via check or electronic payment.

If You Missed the February 17, 2026 Deadline

The standard deadline to submit a Claim Form was February 17, 2026, and that date has now passed. The court-authorized settlement website notes that a different deadline may apply only if a 2026 email notice you received states otherwise.

If you missed the deadline, here is what you are still entitled to:

• If you do nothing, you will still be bound by the Settlement, and you will retain the opportunity to participate in five years of Privacy & Medical Shield + Genetic Monitoring services.
• You will not receive any cash payment.
• You cannot opt out of the settlement, as that deadline passed December 29, 2025.

If you received a 2026 email from the settlement administrator specifically noting a different deadline for your account, that extended deadline controls. Contact Kroll at 833-621-5792 or [email protected] to confirm.

What Happened to My DNA Data After the Bankruptcy Sale?

In July 2025, the TTAM Research Institute, a nonprofit led by 23andMe co-founder and former CEO Anne Wojcicki, completed its purchase of company assets, including customer data. This transfer of genetic data to a new entity raised significant concerns among consumers and state regulators.

Several state attorneys general, including those of California and New York, urged consumers to delete their 23andMe accounts and request deletion of their genetic data under applicable privacy laws. Consumers with specific concerns about the status of their genetic data should visit the official settlement website and review their account settings at 23andme.com (now redirected under the Chrome entity).

Legal Context: Why This Case Matters

The 23andMe settlement is significant for several reasons beyond its dollar value.

Genetic data is uniquely sensitive. Unlike a stolen credit card number, genetic data cannot be changed. The information exposed in this breach — ancestry composition, health predisposition reports, carrier status, and raw genotype data — represents permanent, immutable personal information with implications for employment, insurance, and family members who never consented to any data collection.

Bankruptcy tested the class action process. The proposed settlement came with the company in an “uncertain financial situation,” with plaintiffs’ attorneys informing the court that the defendant’s “challenging financial position presented extraordinary challenges” toward striking a deal to resolve the multidistrict litigation. The fact that a meaningful recovery was achieved through the bankruptcy process sets a useful precedent for future class actions involving financially distressed defendants.

State genetic privacy laws delivered real value. The statutory subclass covering Alaska, California, Illinois, and Oregon demonstrates the practical impact of state-level genetic privacy legislation. Residents of those states received additional compensation specifically because their states enacted laws protecting genetic data.

Frequently Asked Questions

What is the 23andMe class action settlement about?

 The settlement resolves a cyberattack announced by 23andMe on October 6, 2023, which resulted in the theft of personal information from approximately 6.4 million United States residents. The lawsuit alleged that 23andMe failed to adequately protect customers’ personal and genetic data. 23andMe has not admitted any wrongdoing.

Has the settlement been finally approved? 

Yes. The settlement received final court approval on January 30, 2026. No further court approval is needed. Payments are now pending completion of the bankruptcy reconciliation process.

How much will I receive from the 23andMe settlement? 

It depends on which tier applies to you. Payments range from approximately $100 for state statutory claims (Alaska, California, Illinois, Oregon residents), to $165 for those whose health data was compromised, with up to $10,000 available for documented out-of-pocket losses such as identity fraud or unauthorized charges. All eligible class members also receive five years of free genetic monitoring services.

Can I still file a claim after February 17, 2026?

 The standard claim deadline was February 17, 2026, and that date has now passed. A different deadline may apply only if a 2026 email notice you received specifically states otherwise. Contact Kroll at 833-621-5792 to confirm your status.

When will 23andMe settlement payments be sent out? 

Payments will not be disbursed until 23andMe’s bankruptcy reconciliation process is resolved, which is likely to take considerable time. Assuming no appeals, the earliest payments could begin is approximately 60–90 days after the January 30, 2026 final approval — but the bankruptcy process may extend that timeline.

Who owns my 23andMe genetic data now?

 In July 2025, TTAM Research Institute, a nonprofit led by 23andMe co-founder Anne Wojcicki, completed its purchase of 23andMe’s assets, including customer data. Consumers concerned about their genetic data should review their account settings and applicable state privacy law rights.

Is 23andMeDataSettlement.com the only official website? 

Yes. This is the only authorized website for this settlement. Other websites may contain incorrect information about this litigation and should not be relied upon.

Additional Context

The 23andMe breach and settlement represent a pivotal moment in the evolution of genetic data privacy law in the United States. Over 40 separate lawsuits were filed, consolidated across two federal courts, survived a corporate bankruptcy, and ultimately produced a meaningful consumer recovery — all involving data that is, by its nature, impossible to fully remediate once exposed.

The approved 23andMe data breach settlement provides meaningful compensation to roughly 6.9 million U.S. users whose personal and genetic information was exposed in the October 2023 credential stuffing attack. For class members who filed before the deadline, the next step is patience — and keeping contact information current with Kroll so that payments reach you when distribution begins.

Last Updated: March 4, 2026

Disclaimer: This article is for informational purposes only and does not constitute legal advice. Legal claims and outcomes depend on specific facts and applicable law. For advice regarding a particular situation, consult a qualified attorney.

About the Author

Sarah Klein, JD, is a licensed attorney and legal content strategist with over 12 years of experience across civil, criminal, family, and regulatory law. At All About Lawyer, she covers a wide range of legal topics — from high-profile lawsuits and courtroom stories to state traffic laws and everyday legal questions — all with a focus on accuracy, clarity, and public understanding.
Her writing blends real legal insight with plain-English explanations, helping readers stay informed and legally aware.
Read more about Sarah