If you were a 23andMe customer in Canada during the May 2023 to October 2023 data breach, you may be eligible to claim up to CAD $2,500 to cover out-of-pocket expenses directly caused by the security incident. The claims process officially opened following court approvals in both the U.S. (February 17, 2026) and Canada (March 16, 2026), and the settlement affects approximately 320,000 Canadian victims of the cybersecurity breach. For example, if you paid for credit monitoring services or experienced identity theft requiring legal assistance after the breach, those documented expenses could qualify for compensation up to the maximum amount.
The settlement totals CAD $4.5 million for the Canadian Data Breach Settlement Class, though 33% goes to legal fees, and this article explains how to determine your eligibility, what qualifies as a claimable expense, and how to submit your claim before the June 25, 2026 deadline. The distinction between ordinary and extraordinary claims matters for your potential payout. Everyone affected by the breach qualifies for a pro-rata share of remaining settlement funds through an ordinary claim, which requires no documentation. However, if you incurred direct out-of-pocket expenses because of the breach, you can pursue an extraordinary claim and potentially receive up to CAD $2,500 if you provide proper documentation. Understanding which category applies to your situation will determine how much effort you need to put into gathering evidence.
Table of Contents
- How Much Can You Claim and What Types of Claims Exist?
- The Data Breach That Led to This Settlement—What Personal Information Was Exposed?
- Am I Eligible to Claim? Verification and Disqualifying Factors
- How to File Your Claim—Methods and the Step-by-Step Process
- What Disqualifies a Claim or Causes Delays?
- Important Deadlines and Key Dates You Cannot Miss
- What Happens After You Submit Your Claim?
- Frequently Asked Questions
How Much Can You Claim and What Types of Claims Exist?
The Canadian settlement creates two distinct pathways for claiming compensation, each with different requirements and potential payouts. An ordinary claim gives you a pro-rata share of the settlement pool without needing to prove anything—simply submitting that you’re eligible entitles you to your portion of the remaining funds after legal fees are paid. This means your payout will depend on how many other people file claims; if thousands of canadians file ordinary claims, the individual share becomes smaller. However, if you had documented expenses caused directly by the breach, you can file an extraordinary claim instead, which allows you to recover up to CAD $2,500 in unreimbursed costs. Examples of expenses that typically qualify for extraordinary claims include credit monitoring services you purchased after learning about the breach, identity theft insurance premiums, costs associated with replacing documents or dealing with fraudulent charges, and legal fees if you had to address identity theft.
The critical requirement is that these expenses must have been incurred between October 1, 2023 (when the breach became public) and March 31, 2024. If you paid for credit monitoring in May 2024, for instance, that would fall outside the eligible period and wouldn’t count toward an extraordinary claim. You’ll need receipts, credit card statements, or other documentation proving both the expense and the date it occurred. One important limitation: the CAD $2,500 maximum is per claim, not per individual—you cannot file multiple extraordinary claims to reach higher amounts. Additionally, any reimbursements you already received from 23andMe, insurance, or other sources reduce the amount you can claim. If your identity theft insurance already covered CAD $1,200 of your expenses, you can only claim up to CAD $1,300 additional through this settlement.
The Data Breach That Led to This Settlement—What Personal Information Was Exposed?
The breach affected 6.9 million 23andMe customers globally, with approximately 320,000 of those residing in Canada. The security incident occurred across five months, from May 1 through October 1, 2023, giving attackers an extended window to access customer accounts. What made this breach particularly serious was the sensitivity of the data compromised: personal genetic information, health data, race and ethnicity information, gender, family connections showing biological relatives, and birthdates. For someone concerned about privacy, this combination of data is especially troubling because it’s permanent and can’t be changed like a password. The breach wasn’t a single attack but rather a pattern of unauthorized access. Attackers obtained user credentials through credential stuffing (using passwords leaked in previous breaches) and exploited 23andMe’s account security settings.
Many victims didn’t realize their accounts had been accessed until they received notification from the company. Someone with both genetic data and health information exposed faces unique risks—for example, their information could theoretically be used for health insurance discrimination, family relationships could be revealed involuntarily, or genetic data could be misused in ways not yet fully understood. The extended five-month breach period is significant because it means affected individuals might not have discovered the breach immediately and could have incurred expenses well after the initial compromise. However, not everyone who was a 23andMe customer during the breach period was necessarily affected. 23andMe only included people in the settlement class if the company confirmed their personal information was actually compromised, not just everyone who had an account. You should have received official notice from 23andMe if you were included—check your email from that period or visit the official settlement website to verify your status.
Am I Eligible to Claim? Verification and Disqualifying Factors
Eligibility for the Canadian settlement hinges on four specific criteria that you must meet. First, you must have been a 23andMe customer during the May 1 to October 1, 2023 breach window—anyone who signed up after October 1 or stopped using the service before May 1 would not qualify. Second, you must have been residing in Canada during the incident period; those living outside Canada are excluded, even if they’re Canadian citizens. Third, 23andMe must have confirmed that your personal information was actually compromised in the breach; general 23andMe customers from that time period don’t automatically qualify unless their data was specifically affected. Fourth, you must not have previously opted out of the Canadian Data Breach Settlement. The last criterion is important: during an earlier notification process, 23andMe gave customers an opportunity to opt out of the class action. If you previously chose to opt out, you cannot now file a claim.
Check whether you received opt-out communications from 23andMe or the settlement administrator. Conversely, if you never received notice of the settlement at all, you may still be eligible—some victims missed the notification if their contact information was outdated in 23andMe’s records. The official settlement website at canadian23andmesettlement.ca allows you to check your eligibility status directly. A practical example: imagine you were a 23andMe customer from 2022 onwards, received the breach notification from 23andMe in October 2023, and never opted out of the settlement. You clearly meet all four criteria. However, if you lived in the United States but maintained a Canadian address on your 23andMe account, you might not qualify if you didn’t actually reside in Canada. The settlement is specific to Canadian residents, and residency at the time of the breach matters more than citizenship.
How to File Your Claim—Methods and the Step-by-Step Process
Once you’ve confirmed you’re eligible, the claims process is straightforward but requires attention to detail. The settlement administrator accepts claims through multiple channels: online submission through the settlement website, mail, email, or fax. The online method is typically fastest and reduces the risk of missing deadlines, since the system immediately confirms receipt of your submission. If you prefer paper submission, you’ll need to download the claim form from canadian23andmesettlement.ca, complete it with your information, and mail or fax it to the address provided by the deadline. To file an ordinary claim (without seeking the maximum CAD $2,500), you simply need to verify your eligibility by providing your 23andMe account information or customer ID. The settlement administrator will validate that 23andMe confirms you were affected by the breach. This typically takes only a few minutes online.
For an extraordinary claim, the process requires more documentation—you’ll need to submit proof of your out-of-pocket expenses. This means gathering receipts, bank statements, credit card statements, or invoices dated between October 1, 2023 and March 31, 2024 that show expenses directly resulting from the breach. Examples of documentable expenses include credit monitoring service subscriptions, identity theft protection plans you purchased in response to the breach, costs of replacing identification documents, fees paid to address fraudulent charges, or professional fees if you consulted an attorney about identity theft recovery. A crucial point for extraordinary claims: the documentation must clearly link your expenses to the breach. If you purchased credit monitoring because of the 23andMe breach, your receipt should be dated after the breach notification. If you’re claiming identity theft expenses, a police report or your bank’s fraud dispute records can corroborate that the fraudulent activity followed the breach timeline. Submit clear copies of your documentation—don’t assume the settlement administrator will track down receipts or make logical connections for you. Give yourself a buffer before the June 25 deadline; submit claims at least a week or two early rather than on the final day, since technical issues could prevent last-minute submissions.
What Disqualifies a Claim or Causes Delays?
Several common mistakes can result in your claim being rejected or delayed. Submitting an ordinary claim is fast, but providing incomplete information—missing your account ID, unclear name spelling, or inconsistent details—can cause the administrator to request clarification, pushing your case toward the deadline. For extraordinary claims, submitting insufficient or unclear documentation is a primary reason for denial. If you submit a credit card statement showing a CAD $500 charge to a credit monitoring company but the statement is partially cut off or lacks the date, the administrator may reject it as insufficient proof. Make sure your documentation is complete, readable, and clearly shows the amount and date. Another disqualifying factor is claiming expenses outside the eligible window.
The expenses must have been incurred between October 1, 2023 and March 31, 2024—expenses claimed for credit monitoring purchased in September 2023 (before the breach ended) or May 2024 (after the window closed) won’t be covered. Similarly, if you’re claiming reimbursement for expenses already covered by your health insurance, 23andMe credits, or another settlement, the claims administrator will reduce your amount or deny the claim. Double-dipping is prevented by the system: once you’ve received compensation from another source, you can’t claim the same expense again through this settlement. Additionally, submitting duplicate claims—filing both online and by mail for the same incident or filing multiple extraordinary claims for the same category of expense—can result in administrative holds while the claims processor verifies which is the legitimate submission. File once and keep your confirmation number. If you believe you made an error and need to correct your claim, contact the settlement administrator before the deadline rather than resubmitting a new one.
Important Deadlines and Key Dates You Cannot Miss
The single most critical date is June 25, 2026 at 11:59 PM Pacific Time—this is the final deadline for submitting any claim, whether ordinary or extraordinary. Unlike some settlements that extend deadlines or accept late filings, this deadline is firm. Once that date passes, you forfeit your right to claim. Given that we’re in late March 2026, you have approximately three months to investigate your eligibility, gather documentation if applicable, and submit. This is sufficient time, but it requires action now rather than procrastination. For extraordinary claims specifically, there’s an additional deadline: expenses must have been incurred by March 31, 2024 at the latest. This is why checking your bank statements and receipts from that timeframe is urgent.
If you’re uncertain whether you incurred qualifying expenses, review your credit card and bank statements from October 2023 through March 2024 immediately. You might find charges you’d forgotten about—a credit monitoring service that renewed monthly, for instance, or a fee paid to your bank for address change documentation after addressing fraud. Other important dates: the U.S. Bankruptcy Court approved the settlement on February 17, 2026, and the Canadian Court recognized this approval on March 16, 2026. These dates confirm the settlement is active and binding. The settlement was originally negotiated in September 2025. These historical dates matter because they confirm the legitimacy of the settlement—you’re not dealing with a scam or unconfirmed proposal.
What Happens After You Submit Your Claim?
After you submit your claim, the settlement administrator verifies your information and processes it according to whether you filed an ordinary or extraordinary claim. For an ordinary claim, this process is relatively quick—typically within weeks, you’ll receive confirmation that your claim was accepted and processing information about when you can expect payment. The administrator needs only to confirm you’re a legitimate affected customer by cross-referencing with 23andMe’s records. For extraordinary claims, processing takes longer because each submission with documentation must be individually reviewed. An adjuster will examine your receipts and verify that your claimed expenses fall within the eligible dates and qualify as breach-related. If everything is clear and properly documented, your claim should be approved within 4-8 weeks, though complex cases might take longer.
If the administrator has questions—for example, if your documentation is unclear or seems incomplete—they’ll contact you with a request for clarification. It’s critical to respond promptly to any such requests, as delays in responding could push you toward or past the June 25 deadline for new submissions. Once approved, you’ll receive payment information. The exact timeline for receiving your money depends on processing volume and your payment method. The settlement administrator will provide updates on their website and via email if you’ve provided a contact address. During this waiting period, avoid closing or changing the email address and phone number you provided on your claim, as the administrator may need to contact you with updates or questions.
Frequently Asked Questions
Do I need to prove I live in Canada currently to qualify, or does my residency during the breach matter?
Your residency during the May-October 2023 breach period is what matters for eligibility. If you lived in Canada at that time, you qualify even if you’ve since moved elsewhere. However, Canadian residency was required at the time of the incident.
Can I claim both an ordinary claim and an extraordinary claim?
No. You must choose one pathway. If you file an extraordinary claim with documentation, that becomes your claim and you won’t also receive a pro-rata share from the ordinary claim pool. However, if your extraordinary claim is denied or only partially approved, you may still be eligible for the ordinary claim pro-rata distribution.
What if I can’t find my receipts for expenses from 2023-2024?
If your original receipts are lost, contact your credit card company or bank for statements that show the transactions. Many credit monitoring companies will also provide proof of subscription if you contact their customer service. These statement-based documents are acceptable evidence when original receipts aren’t available.
Will this settlement affect my credit score or eligibility for insurance?
Receiving a settlement payout does not appear on your credit report or negatively affect insurance eligibility. Settlement payments are compensation, not debt, and are not reported to credit bureaus.
How much will the average claim be worth?
The pro-rata share depends on how many people file ordinary claims, which won’t be finalized until the deadline passes. It could range from a few dollars to several hundred dollars depending on participation rates. Extraordinary claims are capped at CAD $2,500 based on your actual documented expenses.
What if 23andMe no longer exists or files for bankruptcy—will the settlement still pay?
The settlement is funded and held in a claims fund that’s separate from 23andMe’s ongoing operations. Even if 23andMe’s business status changes, the settlement fund remains dedicated to paying approved claims. The settlement was approved in bankruptcy court, which provides additional protection that funds will be distributed.