23andMe to Pay $30 Million to Settle Genetic Data Breach Lawsuits
The biotech firm will resolve class-action claims after a security failure exposed the personal and genetic data of 6.9 million users.
23andMe has agreed to a $30 million settlement to resolve class-action lawsuits following a massive data breach. The agreement comes after the company failed to protect the sensitive genetic and personal information of approximately 6.9 million users.
The settlement is designed to compensate millions of affected individuals whose data was compromised. The breach specifically targeted users who had opted into the company's 'DNA Relatives' feature, which allows users to find and connect with biological relatives through their genetic profiles.
The Breach Context
The litigation stems from a 2023 security incident where hackers accessed 23andMe's database. By exploiting the 'DNA Relatives' functionality, attackers were able to scrape sensitive genetic ancestry data and personal identifiers. This vulnerability turned a feature intended for family discovery into a tool for mass data extraction, leading to widespread privacy concerns and a wave of legal challenges.
Why It Matters
This case underscores the extreme sensitivity of genetic data, which, unlike a password or credit card number, cannot be changed once leaked. The $30 million settlement reflects the growing legal pressure on biotech and health-tech companies to implement more rigorous security protocols for biological data.
Furthermore, the case has drawn judicial attention to the proportionality of legal rewards in cybersecurity litigation. In this instance, the court has scrutinized the allocation of attorney fees to ensure that the recovery for consumers remains the primary focus of the settlement. This scrutiny highlights a broader tension in class-action suits where legal payouts can sometimes rival the compensation provided to the victims.
What's Next
While the settlement amount has been agreed upon, the final distribution of funds to the 6.9 million affected users remains the next critical step. Legal observers are watching how the court handles the final approval of attorney fees, as the judge has expressed serious concerns regarding the requested legal payouts.
The outcome will likely set a precedent for how courts manage multi-firm collaborations and fee-splitting in future large-scale data breach settlements. As genetic testing becomes more common, the legal framework for protecting biological privacy will continue to evolve, with this case serving as a benchmark for corporate accountability in the biotech sector.