Genetic testing company 23andMe has agreed to pay US$30 million to settle dozens of lawsuits stemming from a data breach that exposed the personal information of 6.4 million users. The breach, which occurred in October 2023, allowed a hacker to access sensitive health data by exploiting stolen usernames and passwords.
The attacker used 23andMe’s DNA Relatives and Family Tree features to view additional information about account holders’ relatives. Some of the stolen data, including details on users of Ashkenazi and Chinese heritage, was posted on the dark web, further escalating concerns over the privacy of genetic information.
In total, 23andMe confirmed that 6.4 million people in the US were affected. Despite this, the company denied any wrongdoing in the settlement, which includes a clause stating that the agreement should not be seen as an admission of fault or liability.
The US$30 million settlement was accepted in July following mediation. Verita, the appointed claims administrator, will oversee the financial disbursements to those affected. Alongside the financial compensation, 23andMe has pledged to implement a range of security enhancements, including better password protections, mandatory multi-factor authentication, and annual cybersecurity audits.
The company has faced international scrutiny, with both Canada and the UK launching investigations into the breach in mid-2024.
23andMe has maintained that users must actively opt into the DNA Relatives feature, arguing that the compromised data cannot be used to cause financial harm or impersonate individuals. However, the breach has raised concerns over the safety of sensitive genetic information and the security of online platforms.
