What Is the 23andMe Lawsuit?
The 23andMe lawsuit is a federal multidistrict litigation, MDL 3098, consolidating nearly 40 class-action complaints filed against the genetic-testing company after a 2023 data breach. The Judicial Panel on Multidistrict Litigation centralized the cases on April 11, 2024, before U.S. District Judge Edward M. Chen in the Northern District of California, and the parties reached a class-action settlement, later increased and finally approved through 23andMe's bankruptcy proceeding.
23andMe announced in early October 2023 that it had discovered unauthorized access to certain customer profile information (the “Security Incident”). The company's own investigation determined that a threat actor downloaded data belonging to roughly 6.4 to 6.9 million people in the United States without authorization, over a period beginning in April 2023. Plaintiffs' Consolidated Class Action Complaint, filed June 26, 2024, asserted claims for failure to properly protect personal information, inadequate data-security protocols, unjust enrichment, and violations of state genetic-information privacy and consumer-protection statutes.
23andMe, Inc. is the named defendant. The company filed for Chapter 11 bankruptcy in March 2025 and later sold substantially all of its assets to TTAM Research Institute, operating today under the corporate name Chrome Holding Co. 23andMe has denied the allegations and has not been found liable.
“This Class Action Settlement Agreement and Release is intended by the Settling Parties to fully, finally, and forever resolve, discharge, and settle the consolidated action In Re: 23andMe, Inc., Customer Data Security Breach Litigation, MDL 3098, Case No. 24-md-03098-EMC.”
Source: Source: Class Action Settlement Agreement and Release, In re: 23andMe, Inc., Customer Data Security Breach Litigation, MDL No. 3098, Case No. 3:24-md-03098-EMC (N.D. Cal., Document 103-2, Sept. 5, 2024)
Why Are People Filing 23andMe Lawsuits?
People filed 23andMe lawsuits because a threat actor accessed the personal and genetic data of millions of customers over a five-month period in 2023, and plaintiffs allege the company's data-security practices and post-breach response fell short of what the law requires. Numerous putative class actions followed the company's own October 2023 breach disclosure.
23andMe's investigation determined the intrusion relied on credential stuffing, reusing usernames and passwords leaked in earlier, unrelated breaches, to access roughly 14,000 individual accounts directly. From those accounts, the attacker pivoted through the platform's own DNA Relatives and Family Tree matching features to reach data tied to an estimated 6.9 million total users, including profile, ancestry, and in some cases health-related information. The complaint alleges the intrusion specifically compromised customers who had opted into DNA Relatives, and that the attacker targeted and later advertised for sale data belonging to Ashkenazi Jewish and Chinese customers in particular.
23andMe publicly attributed part of the incident to customers reusing passwords across other services, a response plaintiffs' counsel criticized as blaming victims rather than addressing the company's own security gaps, including the absence of mandatory two-factor authentication and rate-limiting on login attempts at the time of the intrusion.
What Injuries Are Included in the 23andMe Lawsuit?
The 23andMe lawsuit alleges four distinct categories of harm arising from the 2023 breach and its aftermath, defined in plain language below, followed by what the underlying complaint specifically alleges. 23andMe has denied the allegations in every matter it has not settled.
Exposure of Genetic and Health Data
Genetic data exposure means a third party gained unauthorized access to information about a person's DNA, ancestry, or health-related traits derived from a saliva sample.
The complaint alleges the breach exposed ancestry reports and, for some users, health-predisposition data tied to their genetic profile, information that cannot be reset or reissued the way a password or credit card number can once it is exposed.
Exposure of Personally Identifying Information
Personally identifying information, in this context, is data such as a name, birth year, or general location that can be used on its own or combined with other data to identify a specific individual.
23andMe's own disclosure and the Consolidated Class Action Complaint describe profile information tied to the DNA Relatives feature, including display names, birth years, and self-reported locations, as accessed without authorization for millions of accounts.
Targeted Exposure of Ashkenazi Jewish and Chinese Ancestry Data
Targeted ancestry-group exposure means the intrusion specifically singled out and later advertised data belonging to customers who share a particular ethnic ancestry.
Reporting on the breach and the underlying complaint describe the attacker specifically compiling and offering for sale data profiles of customers identified as being of Ashkenazi Jewish or Chinese descent, a detail plaintiffs argue made the exposure more likely to enable targeted harassment or discrimination.
Unjust Enrichment and Inadequate Data-Security Practices
Unjust enrichment, as a legal claim here, alleges a company benefited financially from collecting and holding customer data while spending less than it should have on securing that data.
The complaint alleges 23andMe was unjustly enriched by using customers' personal information while failing to invest in reasonable safeguards, such as mandatory two-factor authentication, that plaintiffs say could have prevented the credential-stuffing attack from succeeding at the scale it did.
Who Qualifies for the 23andMe Lawsuit?
You may qualify if:
- You were a 23andMe customer with an account any time between May 1, 2023, and October 1, 2023, the window covered by the settlement class
- You submitted a valid claim before the February 17, 2026 deadline (or March 1, 2026, if you were first notified of the settlement on January 5, 2026)
You may not qualify if:
- You did not have a 23andMe account during the covered period
- You did not submit a claim before the deadline; that claims window is closed and cannot be reopened
This describes the now-closed settlement class for the data-breach MDL only. The separate state attorney general actions over 23andMe's bankruptcy sale of genetic data do not create any individual consumer claims process; only a qualified attorney can confirm whether any other avenue applies to your specific situation.
What Is the Current Status of the 23andMe Lawsuit?
The current status of the 23andMe lawsuit differs by proceeding: the federal data-breach MDL has reached final settlement approval and closed its claims window, the bankruptcy sale of the company's assets has been approved and completed, and separate state attorney general lawsuits over the handling and sale of customer genetic data remain active.
MDL 3098 Data Breach Class Action Settlement
The Judicial Panel on Multidistrict Litigation centralized nearly 40 putative class actions into MDL 3098 on April 11, 2024, before Judge Edward M. Chen. The parties reached a $30 million settlement in September 2024, which a bankruptcy judge later increased and gave final approval at $46.75 million on July 7, 2026. The claims deadline, February 17, 2026, has already passed.
| Proceeding Type | Federal multidistrict litigation, certified class-action settlement |
| MDL Number | 3098 |
| Court | U.S. District Court, Northern District of California |
| Presiding Judge | Edward M. Chen |
| Final Settlement Amount | $46.75 million |
| Claims Deadline | Passed, February 17, 2026 |
23andMe Chapter 11 Bankruptcy and TTAM Asset Sale
23andMe filed for Chapter 11 bankruptcy on March 23, 2025, and co-founder Anne Wojcicki resigned as CEO the same day. U.S. Bankruptcy Judge Brian Walsh approved the sale of substantially all of 23andMe's assets to TTAM Research Institute, a nonprofit Wojcicki formed to bid, for $305 million on June 27, 2025, beating an earlier $256 million bid from Regeneron Pharmaceuticals.
| Proceeding Type | Chapter 11 bankruptcy, asset sale |
| Court | U.S. Bankruptcy Court, Eastern District of Missouri |
| Presiding Judge | Brian Walsh |
| Buyer | TTAM Research Institute (nonprofit, led by Anne Wojcicki) |
| Sale Price | $305 million |
| Approved | June 27, 2025 |
State Attorney General Actions Over Genetic Data
Separately from the breach settlement, attorneys general from more than two dozen states and the District of Columbia sued in the bankruptcy case in June 2025 to block the sale of genetic data without customer consent. New York's Attorney General later secured an $18 million multistate settlement of bankruptcy-related claims. California's Attorney General filed a distinct new civil suit against Chrome Holding Co. (23andMe's post-bankruptcy name) on May 28, 2026, over the original 2023 breach.
| Multistate Bankruptcy Objection | 27+ states and D.C., filed June 2025 |
| Multistate Settlement | $18 million, announced by New York Attorney General Letitia James |
| California Civil Suit | People v. Chrome Holding Co., filed May 28, 2026, San Francisco Superior Court |
How Much Did the 23andMe Lawsuit Settle For?
23andMe's data-breach class action settled for $46.75 million in final, court-approved form, up from the $30 million figure the parties originally agreed to in September 2024. Eligible class members could claim up to $10,000 for documented losses, up to $165 for health-information exposure, or a flat statutory payment of roughly $100, though the claims deadline has already passed.
The $46.75 million figure is the actual, bankruptcy-court-approved final settlement amount, not an estimate. It applies only to the federal data-breach MDL and does not include the separate $18 million multistate attorney general settlement over the bankruptcy sale of genetic data, a distinct proceeding with its own separate recovery.
The settlement administrator has said actual payments will not go out until 23andMe's broader bankruptcy reconciliation process is complete, which is expected to take considerable additional time even though the court ordered distribution within five business days of its July 7, 2026 approval.
A separate, smaller Canadian class-action settlement of approximately CA$4.49 million covers Canadian residents affected by the same breach and is administered independently of the U.S. settlement.
Latest 23andMe Lawsuit Updates
Here is the current status of the 23andMe lawsuit, tracking three separate proceedings, the federal data-breach settlement, the bankruptcy sale, and the state attorney general actions, on one interleaved timeline as new filings and rulings are confirmed.
23andMe Lawsuit Timeline
Bankruptcy Judge Gives Final Approval to $46.75 Million Settlement
U.S. Bankruptcy Judge Brian Walsh approved the increased $46.75 million data-breach settlement as fair and in the best interest of the trust overseeing distribution, and ordered the funds distributed within five business days of the order.
California Attorney General Sues Chrome Holding Co. Over the 2023 Breach
California Attorney General Rob Bonta filed a new civil suit in San Francisco Superior Court against Chrome Holding Co., 23andMe's post-bankruptcy corporate name, alleging the company failed to take reasonable measures to protect the data of more than 855,000 California residents affected by the 2023 breach.
Data-Breach Settlement Claims Deadline Passes
The deadline for class members to submit a claim in the data-breach MDL settlement passed on February 17, 2026, closing the window for new claims ahead of the bankruptcy court's later final-approval order.
Bankruptcy Court Approves $305 Million Sale to TTAM Research Institute
U.S. Bankruptcy Judge Brian Walsh approved the sale of substantially all of 23andMe's assets to TTAM Research Institute, a nonprofit led by former CEO Anne Wojcicki, for $305 million, topping an earlier $256 million bid from Regeneron Pharmaceuticals.
More Than Two Dozen States Sue to Block Sale of Genetic Data
Attorneys general from more than two dozen states and the District of Columbia filed suit in 23andMe's bankruptcy case to stop the company from auctioning customer genetic data to the highest bidder without explicit consumer consent.
23andMe Files Chapter 11 Bankruptcy, Wojcicki Resigns as CEO
23andMe filed for Chapter 11 bankruptcy protection in the Eastern District of Missouri, and co-founder Anne Wojcicki resigned as CEO the same day while announcing her intent to bid on the company's assets.
23andMe Agrees to $30 Million Data-Breach Settlement
23andMe agreed to pay $30 million to resolve the consolidated class action over the 2023 breach, an amount later increased through the company's bankruptcy proceeding, with the agreement covering roughly 6.4 million affected U.S. residents.
Plaintiffs File Consolidated Class Action Complaint
Plaintiffs in MDL 3098 filed their Consolidated Class Action Complaint against 23andMe, asserting common-law and statutory claims including inadequate data security, unjust enrichment, and violations of state genetic-privacy laws.
JPML Centralizes Nearly 40 Cases Into MDL 3098
The Judicial Panel on Multidistrict Litigation centralized nearly 40 putative class actions against 23andMe before Judge Edward M. Chen in the Northern District of California for coordinated pretrial proceedings.
23andMe Discloses the Security Incident
23andMe announced it had discovered that certain customer profile information was accessed from individual accounts without authorization, a breach it later determined began in April 2023 and ran for roughly five months.
How to File a 23andMe Lawsuit
Follow these 4 steps to file a 23andMe lawsuit.
- Confirm whether you already submitted a claim: The data-breach settlement's claims deadline passed on February 17, 2026 (or March 1, 2026 for late notice recipients), so a new claim in that settlement cannot be filed at this point.
- Watch for a settlement-administrator payment notice: If you filed a valid claim before the deadline, payment timing depends on 23andMe's broader bankruptcy reconciliation process rather than a fixed date, according to the settlement administrator.
- Review any separate state notice about the bankruptcy sale: If your state attorney general's office reached the separate $18 million multistate settlement or filed its own suit, check that state's own process, since it is unrelated to the closed federal claims window.
- Consult a privacy or consumer-protection attorney for anything not covered here: A qualified attorney can confirm whether any other avenue, such as a state-specific genetic privacy statute claim, still applies to your individual situation.
23andMe Lawsuit is no longer accepting new claims. The $46.75 million data-breach class settlement's claims deadline passed on February 17, 2026, and a bankruptcy judge approved the final settlement amount on July 7, 2026, so no new claims can be filed in that matter. The California Attorney General's separate May 2026 lawsuit against Chrome Holding Co. (23andMe's post-bankruptcy name) does not create a new consumer claims process of its own.
What Did 23andMe Allegedly Know About Its Data-Security Gaps?
The Consolidated Class Action Complaint alleges 23andMe knew its platform lacked basic account-security safeguards, such as mandatory two-factor authentication, and failed to adequately monitor for the kind of credential-stuffing attack that ultimately succeeded. 23andMe has denied these allegations and has not been found liable; the settlement expressly states it is not an admission of wrongdoing.
23andMe's own October 2023 disclosure attributed much of the intrusion's reach to customers reusing login credentials exposed in other companies' breaches, a framing plaintiffs' counsel criticized as shifting blame away from the company's own security architecture, including the DNA Relatives feature that allowed a comparatively small number of compromised accounts to expose data belonging to millions of additional, non-compromised users.
How Does the 23andMe Lawsuit Compare to Related Cases?
The 23andMe data-breach MDL is a legally distinct proceeding from the state attorney general actions over the company's bankruptcy sale of genetic data, even though both arise from the same underlying company and the same pool of customer data.
The multistate coalition of more than two dozen attorneys general, and California's own May 2026 civil suit against Chrome Holding Co., target 23andMe's post-breach conduct, specifically the bankruptcy sale of genetic data and the adequacy of the company's breach response, rather than seeking the same individual monetary recovery the MDL settlement already closed. A separate Canadian class-action settlement, worth approximately CA$4.49 million, resolves claims for Canadian residents under Canadian privacy law and is administered independently of both the U.S. federal settlement and the state attorney general actions.
Frequently Asked Questions
What is the 23andMe lawsuit about?
The 23andMe lawsuit is federal multidistrict litigation, MDL 3098, over a 2023 data breach in which a threat actor accessed personal and genetic data belonging to roughly 6.9 million users, later resolved through a bankruptcy-approved class-action settlement.
Is the 23andMe lawsuit a class action?
Yes, the data-breach matter is a certified federal class-action settlement within MDL 3098. The separate state attorney general lawsuits over the bankruptcy sale of genetic data are government enforcement actions, not private class actions.
Who is the defendant in the 23andMe lawsuit?
23andMe, Inc. is the named defendant, now operating under the corporate name Chrome Holding Co. after selling its operating business to TTAM Research Institute in its 2025 bankruptcy.
Did 23andMe settle the lawsuit?
Yes, 23andMe settled the federal data-breach MDL for $46.75 million in final, bankruptcy-court-approved form, up from the $30 million figure originally agreed in September 2024, though the claims deadline of February 17, 2026 has passed.
Can I still file a claim in the 23andMe lawsuit?
No, the settlement's claims deadline passed on February 17, 2026 (or March 1, 2026 for late notice recipients), and that window cannot be reopened; a qualified attorney can confirm whether any other separate avenue applies to your situation.
Is the California lawsuit against 23andMe the same as the data-breach settlement?
No, California Attorney General Rob Bonta's May 28, 2026 lawsuit against Chrome Holding Co. is a separate, distinct civil enforcement action over the 2023 breach and does not reopen or replace the already-closed federal class-action settlement.