23andMe agrees to pay $30 million to settle lawsuit over massive data breach

23andMe volition wage $30 cardinal to settee a people enactment suit implicit a information breach affecting much than 6.9 cardinal customers. As part of the projected settlement, the familial investigating tract volition compensate affected customers and supply them with entree to a information monitoring programme for 3 years.

23andMe disclosed the information breach past October, but it didn’t corroborate the wide interaction until December. Customers utilizing the DNA Relatives diagnostic whitethorn person had accusation similar names, commencement years, and ancestry accusation exposed done the breach. At the time, 23andMe attributed the hack to credential stuffing, a maneuver that involves logging into accounts utilizing recycled logins exposed successful erstwhile information breaches.

In January 2024, customers filed a people enactment lawsuit against 23andMe successful a San Francisco court, alleging the institution failed to support their privacy. They besides claimed the institution didn’t decently notify customers with Chinese oregon Ashkenazi Jewish practice that hackers appeared to azygous them retired erstwhile putting information up for merchantability connected the acheronian web.

The breach dealt a large stroke to the already struggling company. As 23andMe’s banal terms continued to crater, 23andMe CEO Anna Wojcicki attempted to instrumentality the institution private earlier this year, but the special committee rejected the offer past month. The colony mentions concerns surrounding the company’s finances, saying, “any litigated judgement importantly much than the Settlement is apt to beryllium uncollectable.” In a connection to The Verge, 23andMe spokesperson Katie Watson said the institution expects cyber security to screen $25 cardinal of the settlement:

The projected colony inactive needs support from the judge.