--- title: "Breach claims and settlements" language: en canonical: https://dossiertwist.com/dossiers/case-23andme-holding-co/breach-claims-and-settlements/ as_of: 2026-10-17 keywords: ["23andMe Holding Co.","Chrome Holding Co.","VG Acquisition Corp.","23andMe, Inc.","ChromeCo","Anne Wojcicki","TTAM Research Institute","23andMe Research Institute","Regeneron","Lemonaid Health","Lemonaid SPV","Chapter 11","data breach","credential stuffing","genetic data","Special Committee","Plan Administration Trust","Information Commissioner","California Attorney General","Virgin Group"] --- # Breach claims and settlements **Question.** How were the claims arising from the 2023 breach resolved? **Answer.** Most breach claims were settled inside the bankruptcy. The U.S. class settlement was finally approved on January 30, 2026, at $46.75 million on July 7, 2026, and about 32,000 arbitration claims were resolved in November 2025; Canadian customers received an allowed claim of US$3,250,000. The cyber insurers agreed to pay $16,525,759.63 to buy back their policies. Forty-one states and the District of Columbia agreed in July 2026 to an $18 million payment and five years of conduct limits, subject to court approval. California stayed out: its administrative claim was barred by the plan, and the court ordered it to drop the monetary claims of its 2026 suit, an order it has appealed. ## U.S. class actions and arbitrations - Analysis: After the October 2023 disclosure the company faced more than 40 putative class actions, arbitration claims by about 35,000 claimants and class actions in Canada, as well as government investigations. On April 11, 2024 the federal cases were centralised as MDL No. 3098 before Judge Edward M. Chen in the Northern District of California; on July 29, 2024 the parties agreed a $30.0 million settlement with security measures and three years of monitoring, which received preliminary conditional approval on December 4, 2024, excluding customers who had chosen arbitration. On March 21, 2025 the company also settled with the plaintiffs of the California state actions and with arbitration claimants, bringing its agreed payments to U.S. customers, subject to conditions, to $37.5 million. [src-012] [src-002] - Analysis: In the bankruptcy the debtors signed a U.S. class settlement on August 4, 2025 allowing one class claim of at least $30 million, with distributions capped at $50 million, and a Canadian agreement later replaced by an amended version. On October 2, 2025 the court preliminarily approved the Canadian, U.S. and Lemonaid pixel settlements together, and on November 19, 2025 it approved the U.S. Data Breach Arbitration Agreement of November 17 resolving about 32,000 arbitration claims. The settlement website states that the court granted final approval on January 30, 2026, approved a final amount of $46.75 million on July 7, 2026 and that payments were issued on September 29 and 30, 2026, to a class of about 6.4 million U.S. residents. A news agency reported the same day that the amount would be reduced by $14.29 million already disbursed, leaving $32.46 million; the order itself was not retrieved. [src-012] [src-032] [src-084] [src-043] ## Canada - Analysis: Plaintiffs sued 23andMe Holding Co. and 23andMe, Inc. in the Supreme Court of British Columbia on October 20, 2023 and again on September 18, 2024, adding directors and officers and the auditor KPMG LLP (United States); a proposed Ontario class action of November 24, 2023 was stayed by agreement in favour of the British Columbia actions. The disclosure statement counts three Canadian class actions and the chief restructuring officer two, one per province. On June 5, 2025 the bankruptcy court extended the stay to the directors, officers and KPMG. The U.S. cases were recognised in Canada under the Companies' Creditors Arrangement Act on May 26, 2025, with Matthew Kvarda as foreign representative, and on November 27, 2025 the British Columbia court recognised the U.S. order preliminarily approving the Canadian settlement. [src-012] [src-039] [src-038] - Analysis: Under the amended Canadian settlement of September 5, 2025 the class of Canadian residents notified of the breach has a single claim allowed at US$3,250,000, with distributions capped at that amount, in full settlement of the claims against 23andMe; the claims against the former directors and officers and KPMG are to be dismissed once the plan takes effect and the fund is paid. The settlement is not an admission of liability. Class counsel's fee is 33%, and counsel expected about 64,000 eligible claimants to receive about CA$17.77 each; the final approval hearing was set for February 17, 2026. [src-039] ## The cyber insurers - Analysis: The company's cyber and liability cover for May 1, 2023 to May 1, 2024 totalled $25 million in eroding limits: $15,000,000 from underwriters at Lloyd's, $5,000,000 from Allied World Specialty Insurance Company and $2,500,000 each from Houston Casualty Company and Landmark American Insurance Company. Under a buyback motion of December 1, 2025 the insurers were to pay $16,525,759.63, the limits left after about $8,474,240.37 of defence costs, and take back the policies; the money was reserved for the breach and pixel settlements, and the insurers became released parties. [src-032] [src-016] ## The 42 state and D.C. claimants - Analysis: By the September 19, 2025 bar date 42 state and District of Columbia claimants had filed proofs of claim seeking at least about $100 billion. On July 14, 2026 they signed a stipulation with the Plan Administration Trust and the Wind-Down Debtor allowing their claims at $150 million but limiting payment to $18 million, and barring the debtors for five years from direct consumer sales and from collecting or keeping personal information beyond what the trust needs. The parties settled to avoid the cost and risk of litigation, preserving all defences and without admission of liability. The stipulation takes effect only on a final approval order; the hearing was set for August 10, 2026, and the record does not include the ruling. [src-019] [src-107] - Analysis: Appendix A allots the $18 million among 41 states and the District of Columbia, the largest shares going to Texas ($1,266,860), Florida ($1,111,206) and Indiana ($979,424) and the smallest to South Dakota ($149,339); California is not a signatory. The mutual release covers the debtors, the trust and their officers, directors and affiliates, but expressly not the asset buyer, 23andMe Research Institute. Announcing the settlement, the attorneys general of Colorado and Minnesota said their investigation found the company's data security unreasonable, that it learned of the breach months after the data was public, first denied it and then blamed consumers, and that recovery was limited by the estate's finite funds; they noted that the buyer had accepted strengthened protections. These are the states' conclusions announced with a negotiated settlement, not findings of a court. [src-019] [src-107] [src-044] ## California's claims - Analysis: California said in the bankruptcy court that it might assert an administrative claim for violations of its Genetic Information Privacy Act when the sale to TTAM closed, and its representatives spoke of civil penalties of more than $1 billion; the debtors disputed it, obtained estimation procedures and reserved all rights, and the confirmation order of December 1, 2025 barred California from asserting that administrative claim against the debtors or their estates. [src-012] [src-079] [src-016] - Analysis: On May 27, 2026 the People of the State of California sued Chrome Holding Co., ChromeCo, Inc. and Doe defendants in San Francisco Superior Court (No. CGC-26-636891) over the breach, seeking injunctive relief and civil penalties under four state laws. The trust moved to enforce the plan, relying on its exclusive-jurisdiction provision and injunction; on July 10, 2026 the bankruptcy court held that the jurisdiction provision did not support the motion but that the plan injunction bars the monetary claims, and ordered California within 14 days to dismiss the suit or drop its monetary claims against the two companies. The order leaves the claims against the Doe defendants and non-monetary relief untouched, and the trust's objection to California's proof of claim of September 4, 2025, whose monetary claims the court found essentially similar to the suit's, remained pending. California filed a notice of appeal, transmitted to the Court of Appeals as No. 26-3083 on October 14, 2026; the docket entry does not name the order appealed. [src-075] [src-076] [src-065] ## Sources - [src-012] Disclosure statement for the joint plan of Chrome Holding Co. and its debtor affiliates, Exhibit 99.2 to Form 8-K, U.S. Securities and Exchange Commission (EDGAR), 2025-08 - [src-002] 23andMe Holding Co. Form 8-K reporting the Chapter 11 filing (event of March 21, 2025), U.S. Securities and Exchange Commission (EDGAR), 2025-03-24 - [src-032] Court record source · src-032 - [src-084] Other source · src-084 - [src-043] Media source · src-043 - [src-039] Court record source · src-039 - [src-038] Media source · src-038 - [src-016] Order confirming the modified fifth amended joint plan, Exhibit 2.1 to Form 8-K, U.S. Securities and Exchange Commission (EDGAR), 2025-12-01 - [src-019] Plan Administration Trust's motion to approve the stipulation with the signatory governmental claimants, with the stipulation, Office of the New York State Attorney General (copy of a court filing), 2026-07-14 - [src-107] Minnesota Attorney General press release on the multistate settlement, Office of the Minnesota Attorney General, 2026-07-14 - [src-044] Colorado Attorney General announcement of the multistate settlement of bankruptcy claims, Colorado Department of Law, 2026-07-14 - [src-079] Second amended disclosure statement, Exhibit 99.4 to Form 8-K, U.S. Securities and Exchange Commission (EDGAR), 2025-09 - [src-075] Complaint of the People of the State of California against Chrome Holding Co. and others, California Department of Justice (copy of a court filing) - [src-076] Court record source · src-076 - [src-065] Court record source · src-065