Biotechnology company 23andMe has agreed to pay a $30 million settlement over a massive data breach that affected 6.9 million users.
Per Reuters, the genetic testing company filed a court document on Thursday detailing the settlement in a class action lawsuit in the Northern District of California. In the document, 23andMe proposed compensation for victims of the data breach.
In October 2023, 23andMe announced a data breach in which hackers had stolen users' personal records and genetic information. But it wasn't until December that year that the company revealed the extent of the damage. Around 14,000 users had their information stolen, but hackers leveraged 23andMe's relative-finder tool to access even more users, amounting to the 6.9 million affected.
The class-action lawsuit filed in San Francisco also alleged that 23andMe failed to properly notify users with Chinese and Ashkenazi Jewish heritage who were reportedly singled out for their information on the dark web.
So 23andMe is paying up, but that doesn't mean victims of the breach will get an even distribution of the $30 million. According to the court document, only $5 million is allocated towards compensating the users. Breaking this down further, users who filed for an "extraordinary claim," meaning they suffered financial fraud, are eligible for a $10,000 payout. Others, however, are only entitled to $100. The bulk of the settlement will be used to pay attorney fees.
Through the settlement, 23andMe will be required to boost its cybersecurity measures and provide a customized "Privacy & Medical Shield + Genetic Monitoring" to affected users in order to protect them from future fraud and identify theft issues. Once the settlement proposal is approved by the court, 23andMe will set up a dedicated class-action settlement website where users can file their individual claims.
So if you were one of millions of users affected, stay tuned for more information on how to get your (probably small) piece of the settlement.
