The landscape of the 23andMe data breach litigation and bankruptcy proceedings continues to shift, introducing critical developments for consumers, regulators, and the legal professionals managing fallout from the incident.
Below is the comprehensive timeline and analysis of the 23andMe litigation, detailing the national class-action settlements, multistate investigations, regulatory challenges, and the latest October 2026 proposed California settlement.
In late 2023, a massive security incident compromised approximately 6.9 million consumers worldwide—and roughly 7 million nationwide—exposing sensitive genetic ancestry data, family relationship details, and personal profile information.
The Attack Vector: Threat actors utilized credential stuffing, leveraging usernames and passwords stolen from third-party websites to access accounts where users reused login credentials.
Regulatory & Public Fallout: Investigations revealed that 23andMe failed to implement adequate security protocols, such as multifactor authentication, rate limiting, and proactive intrusion detection. Critics and regulators also pointed out that the company initially downplayed the breach and blamed user password practices.
Struggling under legal and financial pressure, 23andMe filed for Chapter 11 bankruptcy protection in March 2025 (In re: Chrome Holding Co., Case No. 4:25-bk-40976, U.S. Bankruptcy Court for the Eastern District of Missouri).
The Sale to TTAM: During the bankruptcy proceedings, the company’s remaining assets and consumer databases were sold to TTAM Research Institute (later registered as the 23andMe Research Institute), a nonprofit formed by founder and former CEO Anne Wojcicki. The bankruptcy court approved the transaction in June 2025, and it closed in July.
The Genetic Privacy Challenge: The sale sparked intense legal battles. California actively challenged the transfer under its Genetic Information Privacy Act, arguing that transferring sensitive genetic information and biological samples required separate, explicit consumer consent.
The $46.75 Million National Settlement: A national class-action settlement was established through the bankruptcy proceedings to resolve claims for eligible U.S. consumers affected by the 2023 breach. The submission deadline for affected claimants was February 17, 2026.
The $18 Million Multistate Agreement: A coalition of 42 states secured an $18 million bankruptcy claim settlement over allegations of deficient cybersecurity safeguards. Payouts were structured proportionately based on impacted state populations. For example, New Jersey received nearly $410,000 for roughly 150,000 residents, while Pennsylvania secured $492,902 for nearly 200,000 affected individuals. New York also received a proportionate share for its roughly 305,000 impacted residents.
California’s aggressive oversight of the company’s data practices has yielded further legal milestones:
California DOJ Lawsuit: California Attorney General Rob Bonta filed suit against Chrome Holding Co. (formerly 23andMe), targeting the company’s failure to safeguard data for more than 855,000 in-state residents and highlighting months of undetected dark-web exposure.
The October 2026 Proposed Settlement: In October 2026, reporting from Law360 revealed that California reached a proposed settlement of just over $6 million with Chrome Holding Co. Subject to court approval, this agreement resolves pending state claims and appeals stemming from the 2023 breach and the contentious transfer of DNA assets during bankruptcy.
For legal practices managing complex data breach, privacy, consumer protection, or class-action matters, the 23andMe litigation illustrates the immense operational friction that follows large-scale data exposure. Key challenges include:
High-Volume Claimant Identification & Tracking: Managing millions of affected records securely.
Multi-Jurisdictional Coordination: Balancing concurrent state investigations, federal bankruptcy proceedings, and national class-action frameworks.
Data Privacy Compliance: Navigating strict statutory frameworks regarding the transfer and monetization of biological and genetic information.
Managing complex data breach or privacy-related claims requires rigorous data hygiene, secure document workflows, and scalable administrative infrastructure.
Verus partners with law firms to organize complex case data, streamline communications, support settlement administration, and manage high-volume litigation workflows with clarity and control.
Contact Verus today to schedule a discovery call and learn how we can support your next complex matter.
Disclaimer: This article provides information for general knowledge and informational purposes only, and does not constitute legal advice. Readers should consult with qualified legal counsel for advice tailored to their specific circumstances.
Ingrid is an entrepreneurial leader with extensive experience capturing new business opportunities by monitoring competitive landscapes, leveraging consumer insights, and applying data analytics to guide product strategy. She excels in creating marketing campaigns that position brands for success and directing sales teams in securing key leads. Ingrid’s approach combines ROI-driven decisions with creativity, fostering scalable growth and customer loyalty across sectors. She is passionate about challenging the status quo to develop brand stories and concepts that drive both business impact and team empowerment.
