You Can File a Claim in 23andMe’s $30 Million Data Breach Settlement: Here’s What to Know

In 2023, 23andMe got breached. Not just a simple hit—over 6.9 million user profiles were exposed in what turned out to be a targeted, credential-stuffing attack. If you used their DNA Relatives feature, there's a good chance your personal data didn’t just get leaked—it got posted and shared in bulk on forums, including some corners of the dark web.

The attackers didn’t crack any new code. They used stolen login credentials from other sites, hoping customers had reused passwords. And many did. Once inside, the attackers didn’t just take the obvious data—they accessed names, birth years, locations, genetic heritage details, and in some cases, connections to thousands of family members. This wasn’t random. Reports confirmed that users of Ashkenazi Jewish and Chinese descent were deliberately targeted and sorted by ethnicity.

Fast forward to now: 23andMe has agreed to settle. The amount? $30 million. That includes three years of identity theft protection for affected users, and some financial compensation depending on what you lost. According to The Verge, roughly $25 million of the payout is expected to be covered by cyber insurance. The rest is coming out of 23andMe’s own pocket.

You don’t have to guess if you’re eligible. If you received a breach notification email from 23andMe anytime between October 13, 2023, and February 8, 2024, you’re in the affected group. You can file a claim here through the official settlement portal. Deadline is July 14, 2025, and if you don’t file by then, you lose any shot at compensation—period.

This isn’t a class-action payout where you just sign up for $5 and forget about it. If you actually suffered damages—bank fees, account hacks, identity theft headaches, even mental distress from knowing your genetic data was exposed—you can claim real money. You’ll need to back it up with some evidence, but if you’ve got it, now’s the time.

And no, opting into the previous class action doesn’t automatically count. You still need to submit this new claim under the bankruptcy case. That’s a separate process, and skipping it means you get nothing from this $30 million settlement.

Bottom line: if your data was part of that breach, 23andMe owes you. You shouldn’t have to pay the price for their weak safeguards and late response. File your claim and hold them accountable while you still can.