$47 Million Compensation Approval for 23andMe Data Breach Victims

Millions of users of the genetic testing company 23andMe who were affected by the cyberattack in 2023 have finally reached a significant milestone in obtaining fair compensation. A bankruptcy court judge in California ruled that Chrome Holding, which took over the company's control last year, must pay a total of $46.75 million to the victims. The decision recorded that this compensation, equivalent to approximately £35 million, is the result of a major legal and financial battle following the leak of users' highly sensitive genetic data. During the court proceedings, the company's negligence regarding data security and claims that it misled users were brought to light. This compensation ruling closes a chapter of the scandal that tarnished the company's reputation and also sets a potential precedent for similar genetic data breaches.

Details regarding the operation of the compensation process were also clarified in the court ruling. Accordingly, the established $46.75 million fund is planned to be primarily transferred to Kroll Restructuring, a firm appointed to represent the victims. This payment, which is expected to be transferred to Kroll within five business days following the Tuesday the decision was made, will then be distributed to the eligible recipients. The appointment of restructuring and bankruptcy expert firms like Kroll in such processes is considered a standard practice in complex corporate bankruptcy procedures. The legal team representing the victims was also contacted for details regarding how many people will directly benefit from this payment. This structure stands out as a mechanism designed to ensure that the compensation reaches the rightful claimants fairly and transparently.

To understand the scale of the incident and the corporate turmoil the company experienced, one must look at the massive data breach in 2023. At that time, cyber attackers breached 23andMe's systems, initially gaining direct access to approximately 14,000 user accounts. However, due to the company's extensive family tree and kinship connection features, the attackers were able to leverage these accounts to access the profiles of the users' relatives as well. As a result, the highly personal and sensitive genetic, health, and family history information of up to 6.9 million individuals was leaked. Despite only a fraction of the users being directly targeted, this cascading effect of the incident revealed the devastating scale of the data breach. This situation created profound insecurity regarding the safety of users' most intimate data.

This massive data scandal exponentially increased the legal and financial pressure on 23andMe, bringing the company to the brink of bankruptcy. The company was forced to file for bankruptcy approximately 1.5 years after the 2023 cyberattack and put its assets up for sale last year. Following a bankruptcy auction, the company's assets were sold to TTAM Research Institute, led by 23andMe co-founder Anne Wojcicki, with a $305 million offer. Despite the data breach and the subsequent bankruptcy process, it was observed that the company continued its online operations selling DNA test kits. This process clearly illustrates the company's turbulent period, stretching from a $6 billion peak to the depths of bankruptcy.

Following the data breach, the company not only faced financial losses but also encountered severe sanctions and lawsuits from various regulatory bodies. The UK's data protection authority, the Information Commissioner's Office (ICO), accused 23andMe of failing to take adequate measures to secure sensitive user data prior to the incident and imposed a £2.31 million fine on the company. Additionally, California Attorney General Rob Bonta sued the company following an investigation. According to Bonta's claim, the company not only failed to take basic steps to protect user data but also lied to consumers about the severity of the 2023 data breach. Despite being founded in 2006 and going public in 2021, the company, which has never turned a profit, has entered a restructuring process following all these legal and reputational blows.