$46.8M 23andMe breach settlement approved amid bankruptcy liquidation of genetic data assets

Court records show the administrator reduced claims from $48 billion after finding 23andMe's prepetition finances could not sustain larger litigation costs. Nearly 256,000 claims were resolved with tiered payouts capped at $10,000 for severe harm and $50 for minor exposure. Kroll received over $14 million for administration.

The breach, publicly disclosed in October 2023, involved unauthorized access beginning April 2023 that posted data on dark web forums. Family Tree feature data for an additional 14.1 million accounts was also accessed. No CVE was assigned because the vector was credential stuffing rather than a zero-day exploit.

Pre-bankruptcy filings and the March 2025 Chapter 11 petition reveal the firm had already exhausted its core consumer market. Anne Wojcicki's repurchase of assets through Chrome Holding Co. occurred without new privacy covenants on the retained genetic database. This pattern matches prior cases where health-adjacent datasets survive corporate dissolution.

Independent review of the settlement documents indicates no requirement to delete or segregate the exposed profiles post-payout. Future re-identification risk remains elevated given permanent genomic identifiers and secondary data brokers that acquired portions of the liquidated estate.