23andMe data breach settlement
Yes. The 23andMe data breach settlement is real: a $46.75 million class action settlement in the US Bankruptcy Court for the Eastern District of Missouri, run by Kroll Settlement Administration. Payments to people who filed a valid claim have been sent.
The administrator says all submitted claims have been reviewed and payments for approved claims were issued September 29th and 30th, 2026; monitoring enrollment is open.
Is it real?
Yes. The case is In re: 23andMe, Inc. Customer Data Security Breach Litigation (now resolved in In re: Chrome Holding Co., et al.), case number MDL Case No. 24-md-03098-EMC; Bankruptcy Case No. 25-40976-357, in the US Bankruptcy Court for the Eastern District of Missouri. The court appointed Kroll Settlement Administration to run it, and its only official site is 23andmedatasettlement.com.
How the real notice reached people. The settlement notice was emailed with a Claim ID and a unique enrollment code for the monitoring service (the claim form says to use 'the Claim ID provided in the email you received regarding this Settlement', or else the email on your 23andMe account). The administrator does not publish the notice sender address. Payments went out September 29 and 30, 2026; for e-payments the FAQ lists the real senders: Zelle ([email protected], texts from a non-district 5-digit number), PayPal ([email protected], text code 729725), Venmo ([email protected], text code 86753). The administrator cannot change e-payment details for security reasons and will only switch you to a paper check. No separate scam warning is published.
To tell a real message from a scam:
- The only official site is 23andmedatasettlement.com.Type it into your browser yourself rather than tapping a link. Claim pages on news and lawyer-advertising sites, and lookalike addresses, are not the administrator.
- Filing costs nothing.No real settlement charges a fee to file a claim or to release a payment. Anyone asking for one is running a scam.
- Nobody needs your passwords.The administrator never asks for your 23andMe password, your online banking login or a code texted to you. Payment details go only into the claim form on 23andmedatasettlement.com.
- Check by phone.If you aren’t sure a message is real, call the administrator on (833) 621-5792, the number on 23andmedatasettlement.com, not one in the message.
- Claims have closed.The deadline was 17 February 2026. A message now urging you to file a new claim, or to pay or “verify” your bank details to receive money, is a warning sign. Check on 23andmedatasettlement.com instead.
Who qualifies
Anyone who (a) was a 23andMe customer at any time from May 1, 2023 through October 1, 2023, (b) lived in the U.S. during that time, and (c) received notice from 23andMe that their personal information was compromised. Residents of California, Illinois, Oregon or Alaska during that period are also in a Statutory Subclass.
Size: approximately 6.4 million United States residents.
It covers people in the United States only. If you live elsewhere, you are not part of it, whatever a message says.
There are 3 groups, each with its own payments:
- Settlement Class. About 6.4 million U.S. customers notified by 23andMe.
- Statutory Subclass. Class members who lived in Alaska, California, Illinois or Oregon at any time from May 1, 2023 to October 1, 2023.
- Health Information Claim group. Class members whose 23andMe notice said their health information was accessed.
How much
The total settlement is $46.75M (final settlement amount set by the court on July 7, 2026; the agreement provided for a fund between $30 million and $50 million). What each person can claim:
| Benefit | Amount | Notes |
|---|---|---|
| Extraordinary Claims | up to $10,000 | verifiable unreimbursed costs from May 1, 2023 through October 2, 2025 (identity fraud, physical security systems, mental health counseling); total cap $8,300,000, pro rata if exceeded |
| Health Information Claim | up to $165 | for people told their health information was involved; total cap $1,250,000 |
| Statutory Cash Claim | an estimated $100 | Alaska, California, Illinois or Oregon residents; pro rata from what is left |
| Privacy & Medical Shield + Genetic Monitoring | 5 years | enrollment open now with your unique enrollment code, even if you did not file a claim; late enrollment only covers the rest of the five-year term |
- Settlement Class: Extraordinary Claims: up to $10,000; Five years of Privacy & Medical Shield + Genetic Monitoring.
- Statutory Subclass: Statutory Cash Claim: estimated $100, pro rata.
- Health Information Claim group: Health Information Claim: up to $165.
An amount marked estimated or pro rata changes with the number of valid claims: more claims, smaller shares. Losses need proof, such as receipts or bank statements.
Deadline and payout
- Claim deadline: (passed). Deficiency cure forms were due 2026-06-12.
- Opt-out and objection deadline: .
- Final approval hearing: .
- Final approval granted: .
Payout. Payments for approved claims were issued on September 29 and 30, 2026, by paper check or the e-payment method chosen on the claim.
The administrator: “payments for approved Claims were issued September 29th and 30th, 2026.”
Filing and payment
- The claim deadline (February 17, 2026) has passed.
- If you were paid electronically, check spam for a message from Zelle, PayPal or Venmo; to change payment details, use the contact form or call (833) 621-5792 (they can only reissue as a paper check).
- Anyone in the class can still enroll in 5 years of Privacy & Medical Shield + Genetic Monitoring through the enrollment portal linked from 23andmedatasettlement.com, using the unique enrollment code from the notice (call (833) 621-5792 if you lost it).
Official site: 23andmedatasettlement.com. Phone: (833) 621-5792. Mail: 23andMe, c/o Kroll Settlement Administration LLC, PO Box 225391, New York, NY 10150-5391.
The breach, and what to do today
In October 2023 (announced October 6, 2023), 23andMe said it had been the subject of a cyberattack that resulted in unauthorized access to certain personal information of approximately 6.4 million United States residents; the settlement site says the information was or may have been exposed on the dark web.
What was exposed: names; dates of birth; sex; genetic information; predicted relationships with genetic matches; ancestry reports; ancestors' birth locations and family names; family tree information; profile information; geographic location; for some people, health information: uninterpreted raw genotype data, health reports (health-predisposition, wellness, carrier status) or self-reported health conditions.
A settlement pays for what already happened. The data is still out there, so do these now:
- Read your health insurance statements.Check each Explanation of Benefits for care you never had, and tell your insurer if you find any. Medical records can’t be changed like a password.
- Distrust messages about 23andMe and this settlement.Breach data is used to make scam messages personal enough to believe, for years afterwards. Go to the company or the official site yourself.
To see which other breaches your email address is in, search it on Have I Been Pwned, then read Breaches.
Questions
Is the 23andMe data breach settlement legit?
Yes. It is In re: 23andMe, Inc. Customer Data Security Breach Litigation (now resolved in In re: Chrome Holding Co., et al.), case MDL Case No. 24-md-03098-EMC; Bankruptcy Case No. 25-40976-357, in the US Bankruptcy Court for the Eastern District of Missouri. Kroll Settlement Administration runs it for the court, and the only official site is 23andmedatasettlement.com.
Who qualifies for the 23andMe settlement?
Anyone who (a) was a 23andMe customer at any time from May 1, 2023 through October 1, 2023, (b) lived in the U.S. during that time, and (c) received notice from 23andMe that their personal information was compromised. Residents of California, Illinois, Oregon or Alaska during that period are also in a Statutory Subclass.
How much will I get from the 23andMe settlement?
Up to up to $10,000 for losses you can prove, or an estimated $100 as a cash payment without receipts. The total settlement is $46.75M (final settlement amount set by the court on July 7, 2026; the agreement provided for a fund between $30 million and $50 million). Final amounts depend on how many valid claims there are.
What is the deadline for the 23andMe settlement?
The claim deadline was 17 February 2026. It has passed.
When will the 23andMe settlement pay out?
Payments for approved claims were issued on September 29 and 30, 2026, by paper check or the e-payment method chosen on the claim.
Other settlements: California Casualty, Finastra, Telmate, Covenant Health, AMCA, DaVita, and the rest in Settlements.
Sources
Checked on 7 November 2026. HARD is not part of the case and doesn’t take claims.
- 23andMe Data Settlement: home page, Kroll Settlement Administration, read 7 Nov 2026: final approval, $46.75M, payment dates, important dates.
- 23andMe Data Settlement: FAQ, Kroll Settlement Administration, read 7 Nov 2026: benefits, data types, bankruptcy, e-payment senders.
- Order approving settlement amount with U.S. Data Breach Settlement Class (Doc. 2325, filed 07/07/26), US Bankruptcy Court, E.D. Mo., read 7 Nov 2026: approves the Plan Administration Trust's settlement with the class.
- Claim form, Kroll Settlement Administration, read 7 Nov 2026: Claim ID sent by email.