23andMe Data Breach Victims to Receive $46.75 Million Settlement, Largely Funded by Cyber Insurance

One of the most closely watched data-breach settlements in recent years has reached a resolution, with significant lessons for the cyber insurance market. The administrator of the bankruptcy plan for the genetics-testing company once known as 23andMe — now operating as Chrome Holding Co. — has agreed to distribute a total of $46.75 million to victims of a 2023 data breach, ending litigation that has spanned class actions, arbitration claims, and a Chapter 11 reorganisation.

The breach itself, disclosed in October 2023, began around April 2023 through a technique known as credential stuffing, in which attackers used username and password combinations leaked from other companies' breaches to access accounts where customers had reused credentials. The attack ultimately exposed data relating to nearly 7 million customers — close to half of 23andMe's database at the time — including 5.5 million DNA Relatives profiles and 1.4 million Family Tree profiles. The familial and uniquely revealing nature of genetic data made this breach especially consequential.

According to records from the US Bankruptcy Court for the Eastern District of Missouri, the plan administrator will pay $32.5 million to resolve consolidated class-action lawsuits, with the remainder covering the broader universe of claims. Crucially for the insurance industry, of the nearly $14.3 million already distributed to settlement administrator Kroll, approximately $13 million was funded by cyber insurance policies. The insurers that issued cyber coverage to 23andMe included Allied World Specialty Insurance Company, Tokio Marine HCC's Houston Casualty Company, Berkshire Hathaway's Landmark American Insurance Company, and various underwriters at Lloyd's.

Individual payouts range from $50 at the baseline level up to $10,000 for 'extraordinary' claims involving documented serious harm such as identity fraud. The administrator has resolved more than 255,860 claims, with thousands still pending. The $46.75 million total represents a $3.25 million reduction from a January 2026 settlement cap, reflecting the court's view that prolonged litigation would have drained the bankruptcy estate's resources. The case demonstrates how cyber insurance responds when data-breach liability is resolved through bankruptcy rather than against a solvent defendant — with the insurer-funded portion covering only part of the overall settlement economics.