How many users were affected by the 2023 23andMe breach?

The lawsuit cited roughly 7 million affected users, with the breach exposing users' genetic and ancestry data.

Will affected 23andMe customers receive direct payments from this settlement?

The source article does not say whether the settlement includes direct payments to customers, so customers should not assume they will receive compensation.

What should affected customers do now?

They should log in and review their account data, change to a unique long password, and turn on multi-factor authentication (MFA).

23andMe Successor Inks $6M Data Breach Deal With California

Q: What does the proposed $6 million settlement between California and the 23andMe successor resolve?

It would resolve the state's allegations that the genetic testing company failed to protect customers' sensitive information in the 2023 breach, and it would also resolve the state's objection to 23andMe's bankruptcy-related proceedings.

Q: Is the settlement final?

No, it is a proposed settlement that must be approved before it takes effect, and the source does not say when approval might come.

California and the corporate successor to 23andMe have reached a proposed $6 million settlement over the 2023 genetic data breach. The 23andMe California $6M settlement, if approved, would resolve the state's allegations that the genetic testing company failed to protect customers' sensitive information. It would also resolve the state's objection to 23andMe's bankruptcy-related proceedings, according to Law360's summary of the deal. Only a limited portion of the report is available to us, so some details of the terms remain unclear.

What the $6M Settlement Resolves

According to the report, the agreement is between the State of California and the company that succeeded 23andMe. It is not final. The settlement must be approved before it takes effect, and the source does not say when approval might come.

The deal would settle two things. First, it addresses the state's claims that the company did not adequately protect customers' sensitive information in the 2023 breach. Second, it addresses the state's objection to 23andMe's proceedings, which the source summary cuts off before describing in full. We will not guess at the details of that second item.

The settlement follows the state's legal action against the company. For background on the original complaint, see our earlier coverage of California's lawsuit against 23andMe over the 7M-user genetic data breach, which describes the company's operation under the name Chrome Holding Co.

What the 2023 23andMe Breach Exposed

Our earlier reporting described the 2023 incident as a breach that exposed the genetic and ancestry data of users, with the lawsuit citing roughly 7 million affected users. The data involved is what makes this case stand out. A leaked password can be changed. A person's genetic information cannot.

Genetic data can also reveal information about relatives who never signed up for the service. That is one reason regulators treat these cases seriously, and why a single breach can have effects that outlast a typical credential leak.

What This Means For You

If you were a 23andMe customer, this settlement is a reminder that the legal process around a breach can take years, and that money paid to a state does not by itself undo exposure of your data. The source article does not say whether the settlement includes direct payments to customers, so do not assume you will receive compensation.

If you never used the service, the lesson still applies. Many consumer companies hold highly personal data, and their ownership can change through sale or bankruptcy. Data you shared with one company can end up under the control of another.

What Affected Customers Should Do Now

Log in and review your account. Check what data is stored, including genetic results, family matches and any shared profiles.
Change your password. Use a unique, long password that you do not use anywhere else, ideally generated by a password manager.
Turn on multi-factor authentication (MFA). An authenticator app or hardware key is stronger than SMS codes.
Consider deleting your data. If the service offers account deletion and sample destruction, review those options and follow the official steps.
Watch for phishing. People tied to a breach are often targeted with emails or messages that reference the incident. Do not click links in unexpected messages.

Protecting Genetic and Account Data Going Forward

No tool can protect data that a company stores and later loses. A VPN, for example, encrypts your connection, but it does not secure information held on a company's servers. The most effective step is to limit what you hand over in the first place.

Before using any service that collects biometric or health-related data, read its privacy policy, check what happens to your data if the company is sold or goes bankrupt, and look for clear deletion options. Use unique passwords and MFA on every account that holds sensitive information, so one compromised login does not open the door to others.

Breaches of this kind are not isolated. Our coverage of the Texas Parks and Wildlife data breach affecting 3M license holders shows how personal records held by organizations of all kinds can be exposed, which is why minimizing what you share matters.

Key Takeaways

The 23andMe California $6M settlement is still a proposal, and its full terms are not available in the source we reviewed. What is clear is that genetic data is permanent, so protecting it requires more than a strong password. Review your genetic data accounts today, enable MFA, delete stored data where possible, and read our earlier coverage of California's lawsuit over the breach for the full background.