As of July 20, 2026, this case has moved significantly. On July 7, 2026, a U.S. bankruptcy judge approved a $46.75 million data breach settlement for the U.S. class, though the settlement administrator says payments remain paused pending the broader bankruptcy reconciliation process, which could take several more months. The claims window for that settlement closed February 17, 2026, so new claims can no longer be filed. Separately, on July 14, 2026, a coalition of 42 state attorneys general announced a related $18 million multistate settlement with the bankruptcy estate. 23andMe’s assets, including its consumer genetic database, were sold in 2025 to TTAM Research Institute, a nonprofit founded by former CEO Anne Wojcicki, under court-ordered privacy safeguards.
Last updated: July 2026
The 23andMe lawsuit is one of the most significant genetic data breach cases in American legal history. Millions of customers had their most private information, including DNA profiles and health predisposition data, exposed by hackers in 2023, and the legal fallout is still unfolding today.
This is not a simple case. It involves multiple class action lawsuits, a $30 million preliminary settlement, and a company that filed for Chapter 11 bankruptcy in March 2026. Each of those factors affects whether you can collect money and how much.
In this article, you’ll learn what the lawsuit covers, whether you qualify, what the settlement looks like, and what 23andMe’s bankruptcy actually means for your chances of getting paid.
One in three 23andMe users who opted into the DNA Relatives feature had their raw data directly exposed. That detail alone sets this case apart from typical data breach lawsuits.
What Is the 23andMe Lawsuit?
The 23andMe lawsuit refers to a series of class action lawsuits filed against 23andMe Inc. after hackers stole genetic and personal data from approximately 6.9 million customers in a cyberattack first disclosed in October 2023.
The lawsuits claim that 23andMe failed to protect some of the most sensitive personal information that exists: your DNA.
Unlike a stolen credit card number, you can’t change your genetic code. That’s what makes this breach different from most consumer data cases.
The cases were filed across multiple federal courts, with the majority consolidated in the Northern District of California. Plaintiffs allege the company was negligent in its data security practices and violated several state privacy laws.
| Case Basic Facts | Details |
|---|---|
| Company | 23andMe Inc. |
| Data Exposed | DNA profiles, health data, ancestry results, account info |
| Number Affected | Approximately 6.9 million users |
| Attack Type | Credential stuffing cyberattack |
| Primary Courts | Northern District of California |
| Breach Disclosed | October 2023 |
The lawsuits seek damages for financial harm, risk of future harm, and violations of state biometric privacy laws.
How Did the 23andMe Class Action Lawsuit Begin?
The 23andMe class action lawsuit began after the company disclosed in October 2023 that hackers had accessed customer accounts through a “credential stuffing” attack.
Credential stuffing is when hackers use usernames and passwords stolen from other websites to break into accounts on different platforms. If you used the same password on 23andMe that you used elsewhere and that other site was previously hacked, your account was vulnerable.
23andMe initially downplayed the breach. Early statements suggested only a small number of accounts were directly compromised.
That turned out to be misleading. Because of how the DNA Relatives feature works, hackers who got into even a small number of accounts could scrape data from millions of other users who were connected to those accounts through shared DNA matching.
Within weeks of the disclosure, multiple law firms filed class action complaints. The suits multiplied rapidly as the true scale of the breach became clear.
Key figure: Over 40 separate lawsuits were filed within the first few months of the breach disclosure.
What Does the 23andMe Data Breach Lawsuit Actually Claim?
The 23andMe data breach lawsuit claims the company was legally negligent and violated multiple state and federal privacy protections.
The legal claims are specific. They are not just “the company got hacked.”
Plaintiffs argue that 23andMe:
- Failed to require multi-factor authentication before the breach
- Stored sensitive genetic data without adequate encryption safeguards
- Did not monitor for credential stuffing attacks despite known industry risks
- Violated the California Consumer Privacy Act (CCPA)
- Violated the Illinois Biometric Information Privacy Act (BIPA) for users in that state
- Breached its own terms of service and privacy promises to customers
The BIPA claim is particularly significant for Illinois residents. BIPA allows for statutory damages of $1,000 to $5,000 per violation, which could mean a far larger payout for those users compared to claimants in other states.
| Legal Claim | Who It Applies To | Potential Impact |
|---|---|---|
| Negligence | All affected users | Compensatory damages |
| CCPA Violation | California residents | Actual or statutory damages |
| BIPA Violation | Illinois residents | $1,000 to $5,000 per violation |
| Breach of Contract | All users | Damages tied to service promises |
| Unjust Enrichment | All users | Return of financial benefits to 23andMe |
These are serious legal theories. The case was never just about “oops, they got hacked.”
Key Takeaway: The 23andMe class action is built on multiple legal theories, with Illinois residents potentially entitled to the largest individual payouts under BIPA’s statutory damage provisions.
What Is the 23andMe Lawsuit 2026 Update?
As of 2026, the 23andMe lawsuit is at a critical and complicated crossroads because the company filed for Chapter 11 bankruptcy in March 2026.
The preliminary $30 million settlement that was announced in September 2024 has been thrown into uncertainty by the bankruptcy filing. Settlement funds may be at risk depending on how the bankruptcy proceedings unfold.
The bankruptcy court is now involved. Class action claimants are being treated as unsecured creditors, which means they get paid after secured creditors like banks and bondholders.
The Northern District of California court, where the class action is consolidated, is coordinating with the bankruptcy proceedings. It’s a two-track legal situation that has no simple or fast resolution.
Plaintiffs’ attorneys are actively fighting to preserve the $30 million settlement fund and to ensure it remains separate from the bankruptcy estate.
What this means for you: If you haven’t filed a claim yet, doing so now puts you in the queue as a recognized claimant. Waiting could mean missing deadlines tied to the bankruptcy proceedings.
How Does 23andMe’s Bankruptcy Affect Your Claim?
23andMe’s March 2026 bankruptcy filing directly threatens the ability of class action claimants to receive full settlement payments.
Think of it like a restaurant going bankrupt after you’ve already paid for a catered event. The food might never arrive, and you’re now in line with every other creditor hoping to get something back.
In a Chapter 11 bankruptcy, the company reorganizes its debts under court supervision. Class action settlement claimants are typically classified as unsecured creditors.
That means they get paid last. Banks, equipment lenders, and other secured creditors come first.
| Creditor Type | Priority in Bankruptcy |
|---|---|
| Secured creditors (banks, lenders) | First priority |
| Federal and state tax claims | High priority |
| Employee wages and benefits | Protected priority |
| Unsecured creditors (includes settlement claimants) | Low priority |
The $30 million preliminary settlement pool may or may not survive the bankruptcy intact. Plaintiffs’ attorneys are arguing that the settlement funds should be treated as a separate, protected pool outside the bankruptcy estate.
There is no guarantee of that outcome. The bankruptcy court has significant discretion.
Who Qualifies for the 23andMe Lawsuit?
You likely qualify for the 23andMe lawsuit if you were a registered 23andMe customer whose data was compromised in the October 2023 breach.
Eligibility is broad. The class is defined to include customers whose account data, genetic data, or profile data was accessed or scraped during the breach.
You may qualify if:
- You had an active 23andMe account at the time of the breach
- You received a data breach notification from 23andMe
- Your profile data appeared in files posted by hackers online
- You were connected to a compromised account through the DNA Relatives feature, even if your own account was not directly hacked
You do not need proof of financial harm to qualify. The exposure of your genetic data itself is considered a legally cognizable harm under the claims filed.
| Eligibility Factor | Qualifies | Does Not Qualify |
|---|---|---|
| Had 23andMe account in 2023 | Yes | Accounts created after breach disclosed |
| Received breach notification | Yes | N/A |
| DNA Relatives feature user | Yes | N/A |
| No notification received | Possibly | Check breach notification records |
| Non-U.S. customers | Case by case | May face additional hurdles |
If you’re unsure, reviewing the breach notification email from 23andMe is the fastest way to confirm your status.
Key Takeaway: Eligibility is broad and includes users who never got directly hacked but whose data was scraped through the DNA Relatives sharing network.
How Much Is the 23andMe Settlement Amount?
The current 23andMe settlement amount is a $30 million fund established through a preliminary settlement agreement announced in September 2024.
That figure sounds significant. But divided across 6.9 million potential claimants, the math gets uncomfortable quickly.
If every eligible person filed a claim and received an equal share from that fund, the base payout would be roughly $4 per person before attorneys’ fees. Attorneys in class actions typically receive 25% to 33% of the total fund.
In practice, the actual per-person payout depends on several factors:
- How many people actually file claims (most class members never file)
- Whether BIPA or CCPA statutory damages increase individual payouts for certain state residents
- Whether the bankruptcy proceedings reduce the available settlement fund
- Whether courts approve tiered compensation based on the type of data exposed
| Settlement Detail | Current Status |
|---|---|
| Total Fund | $30 million (preliminary) |
| Announcement Date | September 2024 |
| Court Approval Status | Pending, complicated by bankruptcy |
| Attorney Fee Estimate | 25% to 33% of fund |
| Per-Person Estimate (if all claim) | Roughly $4 to $10 |
| Per-Person Estimate (typical low claim rate) | Potentially $50 to $300+ |
The $30 million figure may change. Bankruptcy proceedings could reduce it or restructure how it gets paid.
What Is the 23andMe Lawsuit Payout Per Person?
The 23andMe lawsuit payout per person is not a fixed number. It depends on several legal and logistical variables that are still being resolved in court.
Based on settlement structures in comparable data breach cases, individual payouts in 23andMe’s class action could range from $50 to $500 for most claimants, with significantly higher amounts for Illinois residents asserting BIPA claims.
That range assumes a typical claim participation rate. In most class actions, only 3% to 10% of eligible people actually file claims. That low participation rate pushes individual payouts higher.
| Claimant Category | Estimated Payout Range |
|---|---|
| Standard U.S. claimant | $50 to $300 |
| California resident (CCPA) | $100 to $500 |
| Illinois resident (BIPA) | $1,000 to $5,000 |
| DNA Relatives feature user | May receive higher tier |
| Users with documented financial harm | Higher, case specific |
These are estimates based on similar settlements. No court has set final payment amounts yet.
The bankruptcy proceedings are the biggest wildcard. If the settlement fund gets absorbed into the bankruptcy estate, every payout number changes.
How Do You File a 23andMe Lawsuit Claim?
Filing a 23andMe class action claim requires you to submit your information to the claims administrator once the court approves a formal claims process.
Right now, because of the bankruptcy filing, the formal claims submission portal is in a state of legal flux. Plaintiffs’ attorneys are working to establish the process.
Here’s what you should do right now:
- Locate the breach notification email 23andMe sent you in late 2023 or early 2024. This is your proof of inclusion.
- Keep records of your 23andMe account information, including the email address used to sign up.
- Document any financial harm or identity theft incidents you believe relate to the breach.
- Monitor updates from class action administrators and plaintiffs’ law firms handling the case.
- Do not ignore any correspondence from courts or claims administrators. Missing a deadline could forfeit your right to compensation.
| Step | Action Required |
|---|---|
| 1 | Locate your 23andMe breach notification email |
| 2 | Confirm your account was active during the breach period |
| 3 | Gather account information and any harm documentation |
| 4 | Watch for official claims portal announcement |
| 5 | Submit your claim before the official deadline |
You do not need to hire your own attorney to file a class action claim. The class action attorneys represent all class members.
Key Takeaway: The formal filing portal has not fully opened due to bankruptcy complications, but gathering your documentation now puts you ahead of any deadline when it does.
What Is the 23andMe Lawsuit Deadline?
There is no single confirmed final deadline for the 23andMe lawsuit claim as of mid-2026, because the bankruptcy proceedings have complicated the settlement approval timeline.
This is actually important. The bankruptcy filing effectively paused normal class action timelines. Court orders tied to the bankruptcy reorganization are resetting procedural deadlines.
What we do know:
- The original September 2024 preliminary settlement set claim filing windows that have since been affected by the March 2026 bankruptcy filing.
- Bankruptcy courts set their own creditor claim deadlines, called bar dates. Missing a bankruptcy bar date means losing your right to any payment from the estate.
- Courts are likely to set new deadlines as the bankruptcy and class action cases are resolved together.
What you must do: Watch for official notice of the bankruptcy bar date. This is the single most important deadline for anyone who wants to preserve their claim.
| Deadline Type | Status |
|---|---|
| Original settlement claim deadline | Disrupted by bankruptcy filing |
| Bankruptcy bar date | To be set by bankruptcy court |
| Class certification timeline | Ongoing, court-dependent |
| Settlement approval hearing | Pending, no confirmed date |
When notices arrive, respond immediately. Do not assume you have extra time.
Did the DNA Relatives Feature Make Things Worse?
The DNA Relatives feature made the 23andMe data breach dramatically worse for millions of users who never had their own accounts directly compromised.
Here’s how it worked. The DNA Relatives feature lets 23andMe users see other users who share DNA segments with them. It was an opt-in feature, but a large portion of 23andMe’s user base participated.
When hackers used credential stuffing to access some accounts directly, those compromised accounts were connected to thousands of other profiles through the DNA Relatives network.
That’s how 6.9 million people had their data exposed when only a fraction of accounts were directly breached. The feature turned a limited hack into a mass exposure event.
| DNA Relatives Feature Impact | Detail |
|---|---|
| Feature type | Opt-in DNA matching network |
| Direct breach accounts | Small initial set |
| Cascade exposure | Up to 6.9 million profiles reached |
| Data scraped | Ancestry data, display names, birth years, locations |
| Legal significance | Establishes 23andMe’s liability for indirect exposure |
Users who specifically opted into DNA Relatives may have a stronger legal claim than those who did not, because their decision to participate in an optional feature should not have made them more vulnerable.
What 23andMe Genetic Data Was Actually Exposed?
The 23andMe genetic data breach exposed several distinct categories of personal and biological information, not just login credentials.
This is what sets this lawsuit apart from typical data breaches. The information exposed goes far beyond what you’d lose if your email password was stolen.
Exposed data categories included:
- Full display names and usernames
- Birth years and geographic locations
- Ancestry composition results (ethnic and geographic heritage percentages)
- Chromosome painting data (visual breakdown of DNA origin)
- Haplogroup information (deep ancestral lineage)
- DNA Relatives match lists (showing which other users share DNA)
- Predicted relationship data (whether users are likely relatives)
- Health predisposition results for some users (disease risk data)
The health predisposition data exposure is the most alarming element. Information about your genetic risk for conditions like Parkinson’s disease, breast cancer susceptibility, or Type 2 diabetes is not something you can delete or change.
Key Takeaway: The exposed data includes health predisposition information tied to your actual DNA, making this breach uniquely irreversible and uniquely dangerous for affected customers.
What Happened in the 23andMe Lawsuit 2024 Timeline?
The 23andMe lawsuit 2024 timeline moved quickly from initial breach disclosure to a preliminary settlement, before being complicated by corporate financial collapse.
Here is the full progression of key events:
| Date | Event |
|---|---|
| October 2023 | 23andMe discloses data breach affecting customers |
| October to December 2023 | Over 40 class action lawsuits filed nationwide |
| January 2024 | Cases begin consolidation in Northern District of California |
| April 2024 | 23andMe confirms 6.9 million users were affected |
| June 2024 | Class action mediation begins |
| September 2024 | $30 million preliminary settlement announced |
| Late 2024 | Settlement faces objections from some plaintiff groups |
| March 2026 | 23andMe files for Chapter 11 bankruptcy |
| 2026 (ongoing) | Bankruptcy court takes jurisdiction over settlement fate |
The speed from breach disclosure to preliminary settlement was actually faster than many comparable data breach cases. The $30 million figure was reached in under a year of litigation.
The bankruptcy filing then introduced a level of legal complexity that slowed everything back down.
What Is the Current Class Action Lawsuit 23andMe Status?
The current status of the class action lawsuit against 23andMe is active but significantly complicated by the company’s bankruptcy proceedings in 2026.
The $30 million settlement is in limbo. Plaintiffs’ attorneys are fighting in bankruptcy court to have those funds treated as protected and separate from 23andMe’s general assets.
A final settlement approval hearing has not been confirmed as of mid-2026.
Key ongoing developments:
- Bankruptcy court proceedings are running parallel to the class action
- Plaintiffs are asserting their right to the $30 million as a protected fund
- 23andMe is seeking buyers for its business assets, which could affect the corporate structure involved in the lawsuit
- Several state attorneys general are watching the bankruptcy proceedings closely
- Illinois BIPA claimants may pursue separate legal strategies given their stronger statutory damages position
The case is very much alive. It is not resolved. And the outcome for individual claimants depends heavily on what happens in the bankruptcy court over the next several months.
Is 23andMe Going Out of Business and What Happens to Your Case?
Yes, 23andMe filed for Chapter 11 bankruptcy in March 2026, and the company is actively seeking buyers for its business and assets.
Chapter 11 is a reorganization bankruptcy, not a liquidation. The company is still operating. But its future is genuinely uncertain, and the possibility of full liquidation under Chapter 7 exists if no viable buyer or reorganization plan emerges.
If 23andMe sells its business to a buyer, the genetic data question becomes urgent. Who will own your DNA data after the sale?
Privacy advocates and several members of Congress have raised alarms about the possibility of a buyer acquiring 23andMe’s database of over 14 million genetic profiles.
| Scenario | Impact on Your Lawsuit |
|---|---|
| Successful bankruptcy reorganization | Lawsuit continues, settlement may be reduced |
| Business sold to new buyer | New entity may assume some liabilities |
| Full liquidation (Chapter 7) | Settlement fund may be significantly reduced |
| Court approves protected settlement fund | Original $30M preserved for claimants |
The most important thing to know: filing your claim now, before any bankruptcy bar date is set, protects your place in line regardless of which outcome materializes.
Your legal rights do not disappear because a company goes bankrupt. But you must assert them properly and on time.
Key Takeaway: 23andMe’s bankruptcy makes filing your claim more urgent, not less. Missing a bankruptcy bar date eliminates your right to any payout, no matter what settlement is ultimately approved.
Frequently Asked Questions
What is the 23andMe lawsuit about?
The 23andMe lawsuit is about a 2023 data breach that exposed the genetic and personal data of approximately 6.9 million customers.
Hackers used a credential stuffing attack to access accounts, and the company’s DNA Relatives feature amplified the breach to millions of users who were not directly hacked.
Plaintiffs claim 23andMe was negligent and violated state privacy laws including California’s CCPA and Illinois’s BIPA.
Who qualifies for the 23andMe class action lawsuit?
You qualify if you were a 23andMe customer whose data was compromised in the October 2023 breach.
This includes users who received a breach notification, DNA Relatives feature users whose profile data was scraped, and any account holder whose personal or genetic information appeared in the hacked data files.
You do not need to prove financial harm to qualify.
How much money will I get from the 23andMe settlement?
The current settlement fund is $30 million, but per-person payouts depend on how many people file claims and how the bankruptcy proceedings affect the fund.
Estimates range from $50 to $300 for most claimants, with Illinois residents potentially receiving $1,000 to $5,000 under BIPA’s statutory damages.
No final payout amounts have been approved by the court.
How do I file a claim in the 23andMe class action lawsuit?
The formal claims portal has not been finalized due to the company’s bankruptcy filing in March 2026.
You should gather your breach notification email, account information, and any documentation of harm, then monitor official settlement administrator announcements for the filing window.
You do not need your own attorney to file a class action claim.
What happens to the 23andMe lawsuit if the company goes bankrupt?
The lawsuit continues, but claimants become unsecured creditors in the bankruptcy proceeding, which means they are lower priority than secured lenders.
Plaintiffs’ attorneys are fighting to have the $30 million settlement fund protected as a separate pool outside the bankruptcy estate.
Missing the bankruptcy court’s creditor bar date would permanently forfeit your right to any compensation.
What You Should Do Right Now
The 23andMe lawsuit is moving on two tracks at once, the class action and the bankruptcy, and the window to protect your claim is open right now.
Pull up that breach notification email. Find your old 23andMe account details. Document anything that connects your harm to this breach.
When the official claims portal and bankruptcy bar date are announced, you need to be ready to file immediately. Delays in cases like this are how eligible claimants end up with nothing.
Your genetic data was exposed without your consent. The courts recognize that as a real legal harm. Make sure you’re counted.
