The most common mistake that can void your 23andMe data breach settlement claim is using a different email address or mailing address than the one linked to your 23andMe account. The settlement administrator, Kroll Settlement Administration, cross-references every submission against 23andMe’s customer records, and a mismatch between your claim and those records is the fastest way to get flagged or rejected outright. Other frequent errors include selecting a compensation tier you don’t actually qualify for, failing to upload required documentation for larger claims, and filing duplicate submissions — all of which can result in your claim being tossed out entirely. The 23andMe settlement, now finalized at $50 million following the company’s bankruptcy restructuring, covers roughly 6.4 million affected U.S.
Residents whose data was exposed in a credential-stuffing attack disclosed in October 2023. The claim deadline of February 17, 2026 has already passed for most claimants, though late notice recipients had until March 1, 2026. If you did file a claim, understanding the mistakes that could still disqualify your submission matters because payments have not yet been distributed — and the settlement administrator is still reviewing claims.
Table of Contents
- What Are the Biggest Mistakes That Can Void Your 23andMe Data Breach Settlement Claim?
- Why Filing Duplicate Claims or Missing Documentation Leads to Automatic Rejection
- How the 23andMe Breach Actually Worked and Why It Matters for Your Claim
- What You Should Do Right Now If You Already Filed a Claim
- Why the Bankruptcy Complicates Everything and What It Means for Payouts
- The Monitoring Services Most Claimants Are Overlooking
- What Comes Next for 23andMe Settlement Claimants
- Frequently Asked Questions
What Are the Biggest Mistakes That Can Void Your 23andMe Data Breach Settlement Claim?
The single most damaging mistake is an identity mismatch. When 23andme disclosed the breach, they had records tying each affected account to a specific email address and, in many cases, a mailing address. If you submitted your claim using a personal Gmail but your 23andMe account was registered under your old work email, the administrator has no automated way to connect your claim to an affected account. The same applies to mailing addresses — someone who moved since creating their 23andMe account and filed under their new address without noting the change could see their claim rejected. Unlike some class action settlements where class membership is broad and loosely verified, this one relies on a specific customer database.
The second major category of errors involves claiming compensation you’re not eligible for. The settlement has distinct tiers: up to $165 for those whose health or genetic data was specifically accessed, roughly $100 for residents of Alaska, California, Illinois, or Oregon under statutory claims, and up to $10,000 for extraordinary out-of-pocket losses. A resident of Texas who checked the box for the $100 statutory payment, for example, would have their claim flagged immediately because that tier is restricted to four specific states. Similarly, someone claiming the $165 health information payment who was never notified by 23andMe that their genetic or health data was accessed would not meet the threshold. These aren’t gray areas — they’re binary qualifications that the administrator can verify against 23andMe’s breach notification records.
Why Filing Duplicate Claims or Missing Documentation Leads to Automatic Rejection
filing more than one claim is a surprisingly common mistake, and it almost always backfires. Some claimants submitted once online and then mailed a paper form as a backup, or filed under both an old and new email address hoping one would stick. The settlement administrator’s system flags duplicates, and rather than picking the valid one, duplicate submissions can trigger a review that delays or disqualifies both. If you’re unsure whether your original claim went through, the correct move is to contact Kroll Settlement Administration directly rather than submitting again.
Documentation failures hit hardest in the extraordinary claims tier, which covers up to $10,000 in unreimbursed expenses tied to the breach. This tier requires actual proof — receipts for credit monitoring services you purchased, invoices from identity theft recovery, records of mental health treatment related to the breach, or evidence of fraudulent charges you can connect to the compromised data. A claimant who simply wrote “I spent about $500 on identity protection” without uploading a single receipt would almost certainly see that claim denied or reduced to a lower tier. However, if your out-of-pocket costs were modest and you primarily want the statutory payment or health information payment, documentation requirements are far less burdensome. The statutory cash claims for residents of the four eligible states, for instance, require only proof of residency — no breach-specific documentation needed.
How the 23andMe Breach Actually Worked and Why It Matters for Your Claim
Understanding the mechanics of the breach helps explain why some claims get approved and others don’t. The attack was a credential-stuffing operation, meaning hackers used passwords leaked from other, unrelated websites to log into 23andMe accounts. About 14,000 accounts were directly compromised this way. But the real damage came through the DNA Relatives feature, which allowed those 14,000 breached accounts to access profile information for approximately 5.5 million DNA Relatives profiles and another 1.4 million Family Tree profiles. The data exposed included display names, predicted genetic relationships, percentage of DNA shared, ancestry information, and in some cases health-related genetic data.
This distinction matters for your claim because the compensation tiers track the type of exposure. If you were one of the roughly 14,000 whose account was directly breached, or if 23andMe sent you a specific notification that your health or genetic data was accessed, you’re in the higher compensation tier — up to $165. If your data was exposed indirectly through the DNA Relatives or Family Tree features, you may still qualify for the statutory payment if you live in an eligible state, or for the baseline monitoring services. A common mistake is assuming that all 6.4 million affected users qualify for the same payout. They don’t, and claiming a tier you weren’t designated for is one of the quickest ways to have your submission kicked back.
What You Should Do Right Now If You Already Filed a Claim
If you submitted a claim before the deadline, the most important thing you can do right now is locate your confirmation number and any confirmation email you received. This is your proof of filing. The settlement administrator states that payments won’t be disbursed until 23andMe’s bankruptcy reconciliation process is resolved, which “is likely to take considerable time.” During that waiting period, disputes can arise — claims can be challenged, reclassified, or flagged for additional review. Without a confirmation number, you have no use if the administrator claims they never received your submission.
There’s a meaningful difference between actively filing a claim and doing nothing. If you took no action by the deadline, you’re still technically bound by the settlement — meaning you’ve released your right to sue 23andMe (now operating under the name “Chrome” following bankruptcy restructuring) over the breach. But you’re only eligible for the five years of free Privacy and Medical Shield plus Genetic Monitoring services from CyEx, not any cash payment. This is a tradeoff that caught many people off guard: by not opting out of the settlement before the deadline, you gave up your right to pursue independent legal action, and by not filing a claim, you gave up the cash. The monitoring services have real value if you use them, but they require you to actively enroll through CyEx.
Why the Bankruptcy Complicates Everything and What It Means for Payouts
The 23andMe settlement carries an unusual wrinkle that most class action settlements don’t: the defendant company filed for bankruptcy during the process. The original settlement was $30 million, but during bankruptcy proceedings, the amount was revised upward to $50 million. U.S. Bankruptcy Judge Brian C. Walsh granted final approval on January 30, 2026.
While a larger settlement sounds like unambiguous good news for claimants, bankruptcy introduces uncertainty about timing and payment logistics that a solvent defendant wouldn’t present. The practical warning here is that claimants should not expect fast payouts. The settlement administrator has stated explicitly that disbursements won’t happen until the bankruptcy reconciliation process is resolved. In typical class action settlements against financially healthy companies, payments often arrive within six to twelve months of final approval. In bankruptcy-adjacent settlements, the timeline can stretch significantly longer because the settlement fund must be reconciled against other creditor claims and the bankruptcy estate’s obligations. If you receive communications asking for updated banking or mailing information before payment, verify them carefully — post-bankruptcy settlements are frequent targets for phishing scams impersonating the settlement administrator.
The Monitoring Services Most Claimants Are Overlooking
Regardless of whether you filed for a cash payment, every eligible class member can receive five years of free Privacy and Medical Shield plus Genetic Monitoring services through CyEx. This benefit is easy to overlook because it doesn’t arrive as a check in the mail, but for people whose genetic and ancestry data was exposed, ongoing monitoring has tangible value.
Genetic data doesn’t change like a credit card number — once it’s out there, the risk persists indefinitely. The monitoring service watches for misuse of your genetic information specifically, which standard credit monitoring services like those offered after typical data breaches don’t cover. If you haven’t enrolled yet, visit the official settlement website at 23andMeDataSettlement.com for instructions on activating this benefit.
What Comes Next for 23andMe Settlement Claimants
The case, formally titled *In re: 23andMe, Inc. Customer Data Security Breach Litigation*, is now in its post-approval phase with Keller Rohrback L.L.P. serving as lead counsel.
The immediate next step is the bankruptcy reconciliation, after which the settlement administrator will begin calculating individual payment amounts and processing disbursements. Final payment amounts will depend on how many valid claims were filed in each tier — if fewer people claimed the $165 health information payment than anticipated, individual payouts in that tier could increase, and vice versa. Claimants should monitor 23andMeDataSettlement.com for updates on the disbursement timeline rather than relying on news coverage, which often reports on settlements at the approval stage but rarely follows up on actual payment dates.
Frequently Asked Questions
Has the 23andMe settlement claim deadline passed?
Yes. The primary deadline was February 17, 2026. Late notice recipients who first received notice on January 5, 2026 had an extended deadline of March 1, 2026. If you missed both deadlines, you are generally excluded from cash payments but may still be eligible for the free monitoring services.
How much will I actually receive from the 23andMe settlement?
It depends on your tier. Health information claimants can receive up to $165, residents of Alaska, California, Illinois, or Oregon can receive roughly $100 in statutory cash, and those with documented out-of-pocket losses can claim up to $10,000. Final amounts may adjust based on the total number of valid claims filed.
When will 23andMe settlement payments be sent out?
Payments have not been distributed yet. The settlement administrator has indicated that disbursements won’t occur until the bankruptcy reconciliation process is resolved, which is expected to take considerable time. No specific payment date has been announced.
What is 23andMe called now?
Following bankruptcy restructuring, 23andMe is now known as “Chrome.” The settlement obligations carry over to the restructured entity.
Can I still sue 23andMe if I didn’t file a claim?
If you didn’t opt out of the settlement before the deadline, you released your claims against 23andMe regardless of whether you filed for payment. You’re still eligible for the free monitoring services, but you cannot pursue independent legal action over this breach.
What should I do if I’m not sure my claim went through?
Contact Kroll Settlement Administration, which is managing the claims process, through the official settlement website at 23andMeDataSettlement.com. Do not file a second claim, as duplicate submissions can result in both being flagged for rejection.
You Might Also Like
- Capital Health Data Breach Settlement: Common Mistakes That Can Void Your Claim
- SiriusXM Robocall And Telemarketing Settlement: Common Mistakes That Can Void Your Claim
- Can You Claim Cash From The 23andMe Customer Data Security Breach Settlement Without Proof