Nearly seven million people who trusted 23andMe with their genetic data could receive a share of $46.75 million after the company’s bankruptcy administrator recommended the payout to settle claims from a 2023 breach. California Attorney General Rob Bonta has separately sued the company, now operating as Chrome Holding Co., alleging it failed to protect user data and misled customers about its security practices. Together, the enforcement action and the bankruptcy filing mark the largest financial reckoning yet for a consumer genetics firm over a single data incident.
Why a $46.75 million genetic-data payout sets a new bar
The breach at 23andMe did not involve a sophisticated hack. Attackers used credential stuffing, a technique that recycles stolen usernames and passwords from other sites, to break into roughly 14,000 individual accounts, according to an Associated Press report. From those accounts, they exploited the platform’s DNA Relatives feature to scrape personal and genetic information belonging to nearly 7 million users. That means about half of the company’s entire customer database was exposed through a vulnerability that basic security measures, such as mandatory multi-factor authentication, could have blocked.
The bankruptcy administrator’s recommendation of a $46.75 million distribution to breach victims, reported by Reuters, would be paid through the company’s insolvency proceedings rather than through a traditional class-action settlement. That distinction matters. In a standard lawsuit, legal fees and administrative costs often consume a large share of the total before affected users see a dollar. A bankruptcy-administered payout follows different rules and timelines, and the per-person amount will depend on how many valid claims are filed against the fund.
The dollar figure also carries weight beyond this single case. State regulators have been watching genetic-data companies with growing concern, and a payout of this size signals that credential-stuffing failures can carry real financial consequences for firms that store biometric or genetic records. If attorneys general in other states adopt similar enforcement postures, the cost of weak authentication on sensitive databases will rise sharply for the industry. For smaller direct-to-consumer DNA firms that operate on thin margins, even a fraction of this liability could be existential.
California’s lawsuit and the security failures alleged against Chrome Holding Co.
Attorney General Bonta filed suit against Chrome Holding Co., the entity formerly known as 23andMe, alleging the company violated California law by failing to implement reasonable security measures before the breach. The California Department of Justice announced the action, stating that the complaint also accuses the company of making misleading statements about how it protected user data. Bonta’s office is seeking civil penalties and injunctive relief that would require the company to overhaul its data-protection practices.
“Californians have a right to trust that companies entrusted with their most sensitive genetic information will protect it,” Bonta said in the announcement. The statement frames the case not just as a breach-response failure but as a consumer-protection violation rooted in deceptive business practices. By targeting the company under its new corporate name, the AG’s office is making clear that a rebrand does not erase liability for past conduct.
The complaint draws a direct line between the company’s security shortcomings and the scale of the exposure. Because 23andMe allowed users to opt into a feature that linked their profiles to genetic relatives, a relatively small number of compromised accounts became the entry point for a far larger data harvest. The 14,000 breached accounts served as keys that unlocked records for millions of other users who never had their own passwords stolen. That architectural choice, combined with the absence of mandatory two-factor authentication at the time, is at the center of California’s legal theory.
Beyond authentication, the lawsuit also scrutinizes how the company communicated risk. According to the attorney general, marketing materials and privacy assurances painted a picture of robust safeguards that did not match the actual controls in place. If a court agrees that those statements were misleading, the case could set a precedent that genetic-testing firms must align their promotional language with specific, verifiable security practices rather than broad assurances.
What breach victims still do not know about the payout
Several questions remain open for the millions of people affected. The bankruptcy administrator’s court filing recommends the $46.75 million figure, but the bankruptcy court has not yet issued a final order approving the distribution. Until that happens, the timeline for when victims would actually receive money is uncertain. The mechanics of filing a claim, the documentation required, and the deadline for submissions have not been publicly detailed in the available filings.
The per-person amount is also unknown. Dividing $46.75 million evenly among nearly 7 million affected individuals would yield roughly $6.68 per person before administrative costs. That arithmetic alone shows the gap between headline settlement numbers and what individual consumers typically receive. Whether the administrator’s plan weights payouts based on the type or sensitivity of data exposed, or whether it treats all affected users equally, has not been disclosed in public reporting.
California’s lawsuit against Chrome Holding Co. adds another layer of uncertainty. If the state wins civil penalties, those funds would flow to the state rather than directly to victims. The interaction between the bankruptcy payout and any penalties or injunctive relief from the AG’s case could affect how much money remains available for distribution. Victims with accounts on the platform should monitor the case records for updates on both the enforcement action and any related court orders.
Why genetic data raises higher stakes than other breaches
The broader question hanging over this case is whether genetic data deserves a different standard of protection than other personal information. Unlike a credit card number or even a Social Security number, DNA cannot be changed if it is exposed. It can reveal health predispositions, ancestry, and familial relationships that extend beyond the individual customer to their relatives, many of whom never consented to having their information inferred or exposed.
That permanence raises the potential for long-term harms that are difficult to quantify. Insurers, employers, or other actors could, in theory, misuse genetic insights even if existing laws restrict such behavior. The mere possibility of future discrimination can chill people’s willingness to participate in genetic research or consumer testing services. For regulators, the 23andMe incident underscores how design choices-such as automatically connecting users through relatives features-can amplify the impact of a relatively small breach into a systemic privacy event.
For the industry, the combined pressure of a multi-million-dollar payout and a high-profile enforcement action sends a clear message: treating genetic data like any other customer record is no longer tenable. Companies that collect DNA information will be expected to adopt stronger authentication, limit the cascading access that one account can provide to others, and give users more granular control over how their genetic relationships are shared. If they fail, the 23andMe case suggests that both bankruptcy courts and state attorneys general are prepared to impose real financial and legal consequences.
David M. Keller is a finance writer based in Columbus, Ohio, covering personal finance and consumer-focused economic topics. He earned his degree in journalism from Ohio University and began his career reporting on local business and economic trends for a regional media outlet. Since then, he has contributed to a variety of online publications, focusing on clear, practical coverage of topics such as cost of living, debt, and everyday financial decision-making.
