23andMe Breach Victims Get a $46.75 Million Settlement, With Cyber Insurers Funding About $13 Million, After the Genetic Testing Firm's Bankruptcy

Victims of the 2023 23andMe data breach are to receive payments under a settlement of $46.75 million, a large part of which was funded by cyber insurance. The figures here come from a report by the insurance news site Beinsure. The report is a secondary source, and the court filings it mentions were not reviewed, so readers who need exact numbers should check the court record. Care is needed with dates: the breach and the first lawsuits date from 2023, while the bankruptcy, the settlement and the claims process occurred in 2025 and 2026.

The settlement

According to the report, the bankruptcy plan administrator for 23andMe, which has been renamed Chrome Holding Co., will pay $46.75 million. Of that, $32.5 million is to settle the consolidated class actions brought by customers over the breach. Nearly $14.3 million has already been paid to Kroll, the claims and administration firm. The report says cyber insurance funded about $13 million of the total.

The amount is $3.25 million below the maximum agreed in the class settlement of January 2026, and below the roughly $48 million the class had sought. The matter is before the United States Bankruptcy Court for the Eastern District of Missouri. Because the company is in bankruptcy, the money is paid through the plan administrator and not directly by an operating business.

The insurers

The insurers named in the report are Allied World Specialty, Houston Casualty (part of Tokio Marine HCC), Landmark American (part of Berkshire Hathaway) and underwriters at Lloyd's. Cyber insurance is designed for this kind of event, covering costs such as notification, investigation and legal settlements. That insurers contributed about $13 million shows the policy responding to a large breach, though the report does not give the policy limits or say how much of the cover was used.

Claims and payments

More than 255,860 claims have been resolved, according to a filing dated June 10. Awards for extraordinary claims range from $50 to $10,000. The report does not provide the number of valid claimants or the average payment, so it is not possible to say what an individual member of the class can expect. As with other settlements, the amount per person depends on the number and type of claims accepted and on the costs deducted from the fund.

The bankruptcy background

23andMe filed for Chapter 11 protection in March 2025. Co-founder Anne Wojcicki bought the company back through the bankruptcy process, and the report notes that California failed to block the sale. The bankruptcy matters for the settlement because it determines who pays and how claims rank. A company with limited cash relies more heavily on insurance, which explains why the insurance contribution is so prominent.

What happened in the breach

The report says the breach was disclosed in October 2023. It began around April 2023 and went on for about five months before it was found. Nearly half of the company's 14.1 million customers were affected. The compromised data included 5.5 million DNA Relatives profiles and 1.4 million Family Tree users. The company has said that the attackers used credentials that customers had reused from other sites, a practice known as credential stuffing, and that multi-factor authentication had been offered since 2019. The first lawsuit, brought by plaintiffs Santana and Kleynburd in the Northern District of California, was filed on October 9 of 2023. These details are the company's account as reported, and the report does not test them.

Why genetic data is different

A password can be changed after a breach, but a person's genetic profile cannot. Data about ancestry and family relationships can also reveal information about relatives who never used the service. That is a reason why regulators and courts treat genetic data carefully, though the report does not discuss specific legal findings.

Lessons for insurers and companies

For companies, the case is a reminder that a breach can cause a long period of litigation and that cyber cover can be an important source of funds. It also shows the limits of cover: the policy contributed about $13 million of a $46.75 million total. For insurers, the case shows the scale of claims arising from a consumer data breach and the importance of policy limits and sub-limits. For consumers, using unique passwords and multi-factor authentication reduces the risk of credential stuffing, which is general advice and not a finding from the case.

The numbers in perspective

Some simple arithmetic helps explain the structure. The $46.75 million total is made up of $32.5 million for the class settlement and nearly $14.3 million already paid to Kroll, which together come to about $46.8 million, matching the headline figure once rounding is allowed for. Cyber insurance funding of about $13 million would therefore represent roughly 28% of the total, a calculation made here from the reported figures and not stated in the report. The remainder presumably came from the estate, though the report does not say so.

The small number of insurers named suggests that the cover was layered: different insurers took different slices of the risk. That is common for large policies, where one insurer rarely takes the whole limit. Lloyd's underwriters, which write through syndicates, often take part of such programmes. The report does not give each insurer's share, and it does not say whether any coverage disputes arose.

Limits

This article relies on a trade report of court filings. Amounts, dates and counts may change as the court process continues. It is general information, not legal advice, and class members should consult the settlement administrator for deadlines and rights.