23andMe to Compensate Data Breach Victims with $46.75 Million Settlement
In a significant ruling, a California bankruptcy court has ordered Chrome Holding, the entity that acquired genetics testing company 23andMe, to distribute a $46.75 million payout to victims affected by a major data breach in 2023. The decision, announced on Tuesday, follows a series of legal challenges surrounding the company’s data security practices.
23andMe, known for its DNA testing kits that compile detailed genetic profiles, faced severe backlash after a data breach compromised the personal information of approximately 6.9 million users. The breach, which occurred last year, raised concerns about the security measures in place to protect sensitive genetic data.
Chrome Holding, operating as TTAM Research Institute and led by 23andMe co-founder Anne Wojcicki, secured the company’s assets in a bankruptcy auction for $305 million. The court’s ruling mandates that the settlement funds be paid to Kroll Restructuring, the firm representing the victims, within five business days. Kroll will subsequently distribute the compensation to those affected by the breach.
The breach not only impacted individual user accounts—around 14,000 were directly accessed—but also allowed hackers to reach the genetic profiles of users’ relatives, leading to a wider exposure of sensitive information. This has raised alarms about the adequacy of 23andMe’s data protection protocols, prompting investigations and regulatory scrutiny.
In response to the breach, the UK’s Information Commissioner’s Office (ICO) imposed a fine of £2.31 million on 23andMe, citing the company’s failure to implement sufficient security measures. The ICO’s investigation highlighted that the company did not take basic precautions to safeguard user data, which is particularly concerning given the sensitive nature of genetic information.
California Attorney General Rob Bonta has also taken action against 23andMe, filing a lawsuit that alleges the company did not adequately protect user data and misrepresented the severity of the breach to consumers. This legal scrutiny underscores the growing demand for accountability in data security practices, particularly for companies handling personal and sensitive information.
Despite these challenges, 23andMe continues to operate, offering DNA testing kits online. The company, founded in 2006 and publicly listed in 2021, has struggled to turn a profit and was once valued at $6 billion. The ongoing legal issues and the fallout from the data breach may further complicate its financial recovery and reputation.
As the situation develops, stakeholders and consumers alike will be watching closely to see how 23andMe addresses its data security shortcomings and the impact of the settlement on the affected individuals. The case serves as a reminder of the critical importance of robust cybersecurity measures in the rapidly evolving landscape of genetic testing and personal data management.
