23andMe data breach settlement claim: How to get compensation

If you were a 23andMe customer whose personal information was compromised in the 2023 cyberattack, you may now be eligible for compensation. Following a massive data breach that exposed the sensitive genetic and personal data of millions of users, 23andMe filed for Chapter 11 bankruptcy protection in March 2025. Affected users have until July 14, 2025 to file a Cyber Security Incident Proof of Claim in the bankruptcy case to preserve their right to seek restitution.

This article provides a complete breakdown of the breach, what the bankruptcy means for affected individuals, who is eligible to file a claim, how the claim process works, what types of compensation are available, and step-by-step instructions on filing your proof of claim correctly and on time.

Why is there a 23andMe data breach settlement claim process?

23andMe, a consumer genetics testing company best known for its DNA-based ancestry kits, disclosed in October 2023 that hackers had accessed the personal and genetic data of approximately 6.9 million customers. The breach affected not only names and birth years but also DNA sharing percentages, ancestry reports, relationship labels, and user-provided location data.

Following the breach, class action lawsuits were filed, and in September 2024, 23andMe agreed to a proposed $30 million settlement. However, in March 2025, the company filed for Chapter 11 bankruptcy protection, putting the settlement on hold and requiring claimants to pursue compensation through the bankruptcy process instead.

Customers who suffered damages now must file a Cyber Security Incident Proof of Claim in the bankruptcy case to preserve their legal rights. This is separate from participation in any class action suit and is the only formal path to potentially receive direct compensation from the company under the supervision of the Bankruptcy Court.

Company background and timeline of events

• 2021: 23andMe goes public via SPAC, reaching a peak market capitalization of over $6 billion.
• October 2023: Data breach disclosed affecting nearly 7 million users.
• September 2024: A $30 million settlement was reached in a class action related to the breach.
• March 23, 2025: 23andMe filed for Chapter 11 bankruptcy in the Eastern District of Missouri.
• March 24, 2025: The company notified customers of their eligibility to file Cyber Security Incident claims.

As of the bankruptcy filing, 23andMe and its 11 subsidiaries—including Lemonaid Health and LPRXOne—are undergoing a restructuring process. The bankruptcy process includes a court-approved mechanism for customers to file claims.

Who is eligible to file a cyber security incident claim?

You may file a claim if all three of the following conditions apply to you:

• You were a 23andMe customer between May 1, 2023 and October 1, 2023.
• You received a formal notification from 23andMe between October 13, 2023 and February 8, 2024, informing you that your data was accessed during the cyberattack.
• You experienced economic damages (such as unreimbursed expenses or losses) or non-economic damages (such as emotional distress) resulting from the breach.

Even if you previously joined a class action lawsuit, believe your state’s statute of limitations has passed, or reached a separate agreement, you must still file a proof of claim in this bankruptcy case to preserve your rights. Claims that are not filed by the deadline will not be eligible for compensation.

What can be claimed as compensation?

Claimants can seek reimbursement for a range of economic and non-economic damages. The Cyber Security Incident Proof of Claim form allows users to detail and submit claims for:

• Costs of security or monitoring services (e.g., credit monitoring, identity protection subscriptions, security software)
• Out-of-pocket expenses such as:
  • Bank fees
  • Replacement costs for compromised documents
  • Costs of communication with banks, creditors, or institutions
• Professional mental health treatment due to the breach
• Lost time spent mitigating the effects of the breach (must be justified with narrative explanation)
• Emotional distress or psychological harm (must be described in detail on the form)

Claimants are encouraged to include any supporting documentation such as receipts, invoices, bank statements, counseling bills, or other evidence to substantiate their losses. If documentation is not available, a detailed explanation of the damages will still be considered.

How to file a Cyber Security Incident Claim

The deadline to submit your claim is July 14, 2025. Submissions must be made by 11:59 p.m. Central Time if filed electronically, or by 4:59 p.m. Central Time if sent via mail or hand delivery. The claim can be submitted through several approved methods:

Online submission (Recommended)

Visit the Kroll Restructuring Administration website:

• https://restructuring.ra.kroll.com/23andMe

Use the “Submit a Claim” portal and follow instructions to upload your completed Cyber Security Incident Proof of Claim form securely.

Mail submission

To file by standard mail, send your completed claim form to:

23andMe Holding Co. Claims Processing Center
c/o Kroll Restructuring Administration LLC
Grand Central Station, PO Box 4850
New York, NY 10163

Overnight courier or hand delivery

Send to:

23andMe Holding Co. Claims Processing Center
c/o Kroll Restructuring Administration LLC
850 3rd Avenue, Suite 412
Brooklyn, NY 11232

Direct submission to bankruptcy court

Clerk of the Court
111 S. 10th St., 4th Floor
St. Louis, MO 63102

For law firms filing consolidated claims

Firms representing 25 or more claimants may file consolidated proofs of claim. Before doing so, the law firm must:

• Obtain signed authorization from each individual claimant
• Prepare a spreadsheet listing individualized information for each client
• Request upload credentials by emailing [email protected] by July 9, 2025

The Bankruptcy Court has approved confidentiality procedures to protect claimant data. Your identity, submitted documentation, and personal details will not be made public. Only authorized parties such as the Court, Kroll, 23andMe legal representatives, and insurers will access your information in accordance with court-approved guidelines.

Information may also be disclosed to government authorities if required under mandatory reporting laws in specific jurisdictions.

What happens if you do not file?

If you do not file a Cyber Security Incident Proof of Claim by the deadline, you may lose all rights to compensation or legal recourse related to the 23andMe breach. You will also be barred from:

• Voting on 23andMe’s bankruptcy reorganization plan
• Receiving any payout or future compensation from the company
• Participating in any settlements tied to the data breach

This applies even if you are part of a pending class action, have contacted a lawyer, or previously filed a separate complaint.

Status of the class action settlement

The $30 million class action settlement reached in 2024 is currently stayed due to the bankruptcy proceedings. The case, MDL No. 3098, is pending in the Northern District of California. According to court documents, the Bankruptcy Court has not yet approved or finalized the plan of reorganization that would govern how any future payouts are made.

This means that participating in the class action is not enough—you must also submit a formal bankruptcy claim to preserve your rights.

Resources and assistance

For questions about the claim process, you may contact the claims administrator, Kroll, at:

• Phone (US and Canada): (888) 367-7556
• Phone (International): +1 (646) 891-5055

While Kroll can provide assistance with the claim process, it cannot offer legal advice. If you are unsure whether your situation qualifies, consider consulting a consumer protection attorney familiar with bankruptcy or data breach claims.

This is a time-sensitive legal process

The 23andMe data breach settlement claim process offers a rare and critical chance for individuals to hold a company accountable for the mishandling of sensitive personal data. While the bankruptcy filing complicates the legal landscape, it also opens the door for affected users to file direct claims and seek restitution. Do not assume that past class action participation or prior complaints are sufficient. If you received a breach notice from 23andMe, file a claim before July 14, 2025 to protect your legal rights and secure your eligibility for compensation.