Millions of 23andMe customers who had their genetic data exposed in a 2023 breach will split a $46.75 million settlement fund, but the payout is being carved from a bankruptcy estate with limited assets rather than from a thriving company. A separate $18 million recovery goes to state attorneys general who filed claims in the same proceedings. Affected consumers face a single deadline to file: February 17, 2026.
How bankruptcy shaped the $46.75 million and $18 million payouts
The two settlement tracks emerged from the same Chapter 11 case, filed as Chrome Holding Co., Case 25-40976, in the U.S. Bankruptcy Court for the Eastern District of Missouri. That procedural detail matters because it means neither the $46.75 million consumer fund nor the $18 million state recovery was set by a jury or calculated from individual breach damages. Both figures reflect what the bankrupt estate could afford to pay, distributed across all eligible claimants at once.
The consumer class action runs in parallel with multidistrict litigation captioned IN RE: 23ANDME, Inc., Customer Data Security Breach Litigation (24-md-03098) in the Northern District of California, where consolidated complaints and pretrial orders are housed on the federal docket. The bankruptcy court, however, controls the money. That structure gives the settlement a uniform claims deadline across all jurisdictions, preventing state-by-state fragmentation that could drain the estate through competing litigation.
Because the settlement is tied to a reorganization plan, the consumer fund and the state recovery are effectively competing with other creditors for pieces of the same limited pie. The more money reserved for one group, the less remains for others such as trade creditors or bondholders. That dynamic helps explain why the consumer fund and the separate $18 million in state payments were negotiated together, then presented as a package to the bankruptcy judge for approval.
Once the court gives final approval, distributions will depend on how many people file valid claims by the February 17, 2026 deadline. If participation is high, individual checks will be smaller; if fewer people file, each approved claimant will receive a larger share. Either way, the total consumer fund will not grow beyond $46.75 million, because that amount is capped by the confirmed bankruptcy plan rather than by ongoing litigation risk.
State attorneys general and the evidence trail
Illinois Attorney General Kwame Raoul, South Carolina Attorney General Alan Wilson, and Arizona Attorney General Kris Mayes each announced the deal through their offices. The Illinois announcement confirmed both the $46.75 million class-action settlement for affected U.S. consumers and the $18 million multistate recovery resolving states’ bankruptcy claims. The South Carolina release added that 6.9 million individuals worldwide were affected by the breach. Arizona’s attorney general emphasized in a separate statement that the settlement is meant to hold the company accountable for allowing highly sensitive genetic information to be sold on the dark web.
The multistate coalition treated the breach as a consumer protection failure, not just a cybersecurity incident. Genetic data carries risks that go beyond financial fraud. Unlike a stolen credit card number, a DNA profile cannot be reissued or fully anonymized once exposed. That distinction drove the attorneys general to pursue claims even after 23andMe entered bankruptcy, when many creditors might have written off their losses as unrecoverable.
State officials also framed the case as a warning to other companies that collect and monetize genetic information. By insisting on a dedicated consumer fund inside the bankruptcy process, they signaled that privacy violations involving immutable biometric data will attract aggressive enforcement, even if a company later seeks shelter in Chapter 11.
What affected customers still do not know
Several practical questions remain unanswered. No public document from the attorneys general or the bankruptcy court specifies how much each individual claimant can expect to receive. The per-person payment will depend on how the settlement administrator calculates eligible claims, how many people file, and what administrative costs are deducted from the fund before distribution.
Consumers also lack detail about how claims will be prioritized. The public announcements do not indicate whether all affected users will be treated identically or whether higher-risk categories-such as those whose genetic profiles were specifically advertised or sold online-might receive larger payments. Nor is it clear whether customers outside the United States, who were among the 6.9 million impacted individuals, will have any recourse through this particular settlement, which is structured around U.S. bankruptcy and consumer protection laws.
Another open question is how much non-monetary relief, if any, will accompany the cash payouts. The attorneys general have not publicly detailed any mandated security upgrades, data minimization requirements, or independent audits tied to the settlement. For many privacy advocates, such structural changes matter as much as compensation, because they determine whether a similar breach is less likely to happen again.
For now, affected customers know three concrete things: the total consumer fund is fixed at $46.75 million, the states will receive $18 million for their own claims and enforcement efforts, and everyone who wants a share must meet the February 17, 2026 filing deadline. The rest-the size of the checks, the scope of any reforms, and the long-term impact on genetic privacy-will only become clear as the bankruptcy case moves from approval to implementation and the settlement administrator begins the work of turning a finite estate into millions of individual payments.
Free for readers: The free Retirement Shield newsletter sends plain-English help keeping more of your money in retirement — the scams to dodge, the benefits you’re owed, and what’s changing with Social Security and Medicare, a couple times a week. Get the free newsletter.
