Breach claims and settlements

analysisAfter the October 2023 disclosure the company faced more than 40 putative class actions, arbitration claims by about 35,000 claimants and class actions in Canada, as well as government investigations. On April 11, 2024 the federal cases were centralised as MDL No. 3098 before Judge Edward M. Chen in the Northern District of California; on July 29, 2024 the parties agreed a $30.0 million settlement with security measures and three years of monitoring, which received preliminary conditional approval on December 4, 2024, excluding customers who had chosen arbitration. On March 21, 2025 the company also settled with the plaintiffs of the California state actions and with arbitration claimants, bringing its agreed payments to U.S. customers, subject to conditions, to $37.5 million. ^{1 2}

analysisIn the bankruptcy the debtors signed a U.S. class settlement on August 4, 2025 allowing one class claim of at least $30 million, with distributions capped at $50 million, and a Canadian agreement later replaced by an amended version. On October 2, 2025 the court preliminarily approved the Canadian, U.S. and Lemonaid pixel settlements together, and on November 19, 2025 it approved the U.S. Data Breach Arbitration Agreement of November 17 resolving about 32,000 arbitration claims. The settlement website states that the court granted final approval on January 30, 2026, approved a final amount of $46.75 million on July 7, 2026 and that payments were issued on September 29 and 30, 2026, to a class of about 6.4 million U.S. residents. A news agency reported the same day that the amount would be reduced by $14.29 million already disbursed, leaving $32.46 million; the order itself was not retrieved. ^{1 3 4 5}

analysisPlaintiffs sued 23andMe Holding Co. and 23andMe, Inc. in the Supreme Court of British Columbia on October 20, 2023 and again on September 18, 2024, adding directors and officers and the auditor KPMG LLP (United States); a proposed Ontario class action of November 24, 2023 was stayed by agreement in favour of the British Columbia actions. The disclosure statement counts three Canadian class actions and the chief restructuring officer two, one per province. On June 5, 2025 the bankruptcy court extended the stay to the directors, officers and KPMG. The U.S. cases were recognised in Canada under the Companies' Creditors Arrangement Act on May 26, 2025, with Matthew Kvarda as foreign representative, and on November 27, 2025 the British Columbia court recognised the U.S. order preliminarily approving the Canadian settlement. ^{1 2 3}

analysisUnder the amended Canadian settlement of September 5, 2025 the class of Canadian residents notified of the breach has a single claim allowed at US$3,250,000, with distributions capped at that amount, in full settlement of the claims against 23andMe; the claims against the former directors and officers and KPMG are to be dismissed once the plan takes effect and the fund is paid. The settlement is not an admission of liability. Class counsel's fee is 33%, and counsel expected about 64,000 eligible claimants to receive about CA$17.77 each; the final approval hearing was set for February 17, 2026. ²

analysisThe company's cyber and liability cover for May 1, 2023 to May 1, 2024 totalled $25 million in eroding limits: $15,000,000 from underwriters at Lloyd's, $5,000,000 from Allied World Specialty Insurance Company and $2,500,000 each from Houston Casualty Company and Landmark American Insurance Company. Under a buyback motion of December 1, 2025 the insurers were to pay $16,525,759.63, the limits left after about $8,474,240.37 of defence costs, and take back the policies; the money was reserved for the breach and pixel settlements, and the insurers became released parties. ^{1 2}

analysisBy the September 19, 2025 bar date 42 state and District of Columbia claimants had filed proofs of claim seeking at least about $100 billion. On July 14, 2026 they signed a stipulation with the Plan Administration Trust and the Wind-Down Debtor allowing their claims at $150 million but limiting payment to $18 million, and barring the debtors for five years from direct consumer sales and from collecting or keeping personal information beyond what the trust needs. The parties settled to avoid the cost and risk of litigation, preserving all defences and without admission of liability. The stipulation takes effect only on a final approval order; the hearing was set for August 10, 2026, and the record does not include the ruling. ^{1 2}

analysisAppendix A allots the $18 million among 41 states and the District of Columbia, the largest shares going to Texas ($1,266,860), Florida ($1,111,206) and Indiana ($979,424) and the smallest to South Dakota ($149,339); California is not a signatory. The mutual release covers the debtors, the trust and their officers, directors and affiliates, but expressly not the asset buyer, 23andMe Research Institute. Announcing the settlement, the attorneys general of Colorado and Minnesota said their investigation found the company's data security unreasonable, that it learned of the breach months after the data was public, first denied it and then blamed consumers, and that recovery was limited by the estate's finite funds; they noted that the buyer had accepted strengthened protections. These are the states' conclusions announced with a negotiated settlement, not findings of a court. ^{1 2 3}

analysisCalifornia said in the bankruptcy court that it might assert an administrative claim for violations of its Genetic Information Privacy Act when the sale to TTAM closed, and its representatives spoke of civil penalties of more than $1 billion; the debtors disputed it, obtained estimation procedures and reserved all rights, and the confirmation order of December 1, 2025 barred California from asserting that administrative claim against the debtors or their estates. ^{1 2 3}

analysisOn May 27, 2026 the People of the State of California sued Chrome Holding Co., ChromeCo, Inc. and Doe defendants in San Francisco Superior Court (No. CGC-26-636891) over the breach, seeking injunctive relief and civil penalties under four state laws. The trust moved to enforce the plan, relying on its exclusive-jurisdiction provision and injunction; on July 10, 2026 the bankruptcy court held that the jurisdiction provision did not support the motion but that the plan injunction bars the monetary claims, and ordered California within 14 days to dismiss the suit or drop its monetary claims against the two companies. The order leaves the claims against the Doe defendants and non-monetary relief untouched, and the trust's objection to California's proof of claim of September 4, 2025, whose monetary claims the court found essentially similar to the suit's, remained pending. California filed a notice of appeal, transmitted to the Court of Appeals as No. 26-3083 on October 14, 2026; the docket entry does not name the order appealed. ^{4 5 6}