23andMe Data Breach Settlement Approved: $46.75 Million Final Order Explained

23andMe Data Breach Settlement Approved: $46.75 Million Final Order Explained

A federal bankruptcy judge granted final approval on July 6, 2026, to a $46.75 million consumer class-action settlement over the 2023 23andMe data breach, which exposed genetic and personal data tied to roughly 6.9 million people. The order clears the way for the remaining settlement funds to move to the claims administrator for distribution.

Information last verified on July 18, 2026. This is a developing story; we update it as the record changes.

Jurisdiction scope: This article covers the federal 23andMe bankruptcy/data-breach settlement approved in the U.S. Bankruptcy Court for the Eastern District of Missouri. It is general information about a nationwide class settlement, not advice about your individual claim.

What Happened

U.S. Bankruptcy Judge Brian C. Walsh of the U.S. Bankruptcy Court for the Eastern District of Missouri entered a final order on July 6, 2026, approving a $46.75 million class-action settlement resolving consumer claims tied to 23andMe's 2023 data breach (In re 23andMe Holding Co., No. 25-40976). The court found the settlement 'fair and equitable' to the class. Of the total fund, approximately $14.29 million had already been disbursed to victims before the final order, leaving roughly $32.46 million still to be distributed. The order directs that the remaining funds be transferred to claims administrator Kroll Restructuring Administration within five business days, after which Kroll handles distribution to eligible claimants. The underlying breach compromised genetic and personal data connected to up to 6.9 million people, nearly half of 23andMe's customer base at the time, because a credential-stuffing attack on a comparatively small number of accounts cascaded outward through the platform's DNA-relative matching feature, exposing profiles of millions of connected relatives who had not had their own credentials compromised.

The settlement is being administered inside 23andMe's Chapter 11 bankruptcy case. The company's assets were sold out of bankruptcy in 2025, and payments to the class are subject to the bankruptcy court's reconciliation process, which is why distribution runs through a claims trust and administrator rather than a direct company payout.

What the Settlement Pays

Most eligible class members should expect a modest cash payment, not a large one. The settlement's realistic baseline outcome is an estimated statutory cash claim of roughly $100 per claimant, since that tier applies broadly across the class. A separate tier covers claims tied specifically to health information, capped at up to $165. A third, much narrower tier allows for documented extraordinary losses, such as demonstrated identity theft or verified out-of-pocket costs tied to the breach, up to a $10,000 ceiling. That $10,000 figure is a maximum reserved for claimants who submitted supporting documentation of concrete harm; it is not a typical or expected payment. Beyond cash, the settlement also provides multiple years of genetic-data and privacy monitoring benefits to class members, which is a meaningful part of the relief given that genetic information cannot be reset or reissued the way a credit card number can.

Because the fund is finite and payouts are pro-rata within each tier, the actual dollar amount any individual receives depends on how many claimants qualify within that tier and how the bankruptcy reconciliation process finalizes the numbers. Class members should treat the small statutory tier, not the $10,000 ceiling, as the realistic expectation.

How This Is Different From the $18 Million State Settlement

This $46.75 million order should not be confused with the separate $18 million settlement 23andMe reached with 42 state attorneys general, announced July 14, 2026. That earlier settlement resolved state government enforcement claims and paid money to the states themselves, not to individual consumers. The $46.75 million fund covered in this article is the consumer class-action settlement, and it is the one from which individual victims can potentially receive a payment. Readers who want background on the state settlement can review the separate $18 million state attorneys general settlement coverage on this site; the two matters arose from the same underlying breach but proceeded on different legal tracks with different beneficiaries.

What Class Members Should Do Now

Anyone who believes they may be part of the settlement class should check their claim status only through the official claims administrator, Kroll Restructuring Administration, or the official settlement website. This site is not the settlement administrator, the court, or a claim-filing venue, and cannot confirm individual eligibility or payment amounts. Given how many settlement-related scam sites and phishing attempts follow major data breach news, class members should be cautious of any email, text, or website that asks for payment, banking details, or a Social Security number in order to 'process' a claim; the legitimate administrator does not charge a fee to receive a settlement payment.

In the meantime, a free credit freeze remains one of the simplest and most effective protective steps available and should be a first move regardless of settlement timing. Class members should also take advantage of the free monitoring benefits included in the settlement rather than immediately purchasing a paid product. For broader guidance, this site's pages on how to freeze your credit and general steps to take after a data breach walk through the practical steps in more detail.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

Genetic data occupies a different risk category than a password or a credit card number. A stolen card can be canceled and reissued; a person's DNA profile cannot be changed, which is part of why the settlement includes years of ongoing monitoring rather than a one-time payment alone. The bankruptcy context also matters for what recovery looks like in practice: because 23andMe reorganized and sold its assets, the settlement fund is fixed and administered through a bankruptcy trust rather than an open-ended corporate liability, which caps what the class can ultimately recover regardless of the scale of the harm. Finally, the mechanics of this breach, in which a relatively contained credential-stuffing attack on a limited set of accounts cascaded to millions of relatives through a DNA-matching feature, illustrates how interconnected consumer platforms can turn a narrow security failure into a much larger exposure event. That dynamic is worth remembering well beyond this one company.

This is general legal information, not legal advice. It covers a federal class-action settlement and reflects sources verified on July 18, 2026. Laws and settlement administration change and this story is developing; consult a lawyer licensed in your jurisdiction about your specific situation.

Related articles

• track the status of this settlement
• the separate $18 million state attorneys general settlement
• freeze your credit

---

Last updated: 2026-07-18. This is a developing story; details verified as of 2026-07-18.