23andMe seeks approval of larger, $50 million data breach settlement

Genetics testing company 23andMe is seeking federal bankruptcy court approval for an expanded $50 million settlement to resolve claims from its 2023 data breach, which exposed personal information of approximately 6.4 million U.S. customers. This revised offer, up from a prior $30 million settlement, follows 23andMe's Chapter 11 filing in March and is funded by the $305 million sale of its assets to a founder-controlled nonprofit, which lawyers state is the sole source of recovery for victims. The settlement aims to resolve a substantial majority of U.S. claims, including allegations of targeted data exposure for specific ethnic groups, and provides affected class members with five years of identity protection services.

Analysis

23andMe, operating under Chapter 11 bankruptcy protection since March, is seeking court approval for an expanded $50 million settlement to resolve claims from a 2023 data breach that affected 6.4 million customers. This revised settlement, an increase from a pre-bankruptcy $30 million figure, is funded entirely by the proceeds of a $305 million asset sale to a nonprofit controlled by founder Anne Wojcicki. According to the company's lawyers, this sale represents the sole source of monetary recovery for victims, underscoring the finality of the situation for the original corporate entity. The breach itself was significant, lasting five months and involving allegations that hackers specifically targeted and exposed data of customers with Chinese and Ashkenazi Jewish ancestry. The proposed settlement for over 250,000 claimants not only establishes a compensation fund but also includes five years of identity and genetic monitoring, highlighting the severe and long-tail nature of the risks associated with breaches of sensitive health data.

Key Decisions for Investors

• This case serves as a stark precedent for the financial and reputational costs of inadequate cybersecurity in the biotech and direct-to-consumer healthcare sectors; investors should re-evaluate liability risks and data security protocols in comparable portfolio companies.
• The complete destruction of equity value and reliance on a distressed asset sale for claim recovery highlights the existential threat posed by large-scale data breaches, particularly for companies whose primary asset is user data.
• Given the asset sale to a founder-controlled entity, the underlying technology and data may have a future in a new private structure, but for public market investors, this event marks a total loss and a cautionary tale on governance and risk management.