The 23andMe data breach settlement offers up to $30 million in compensation to roughly 6.9 million affected U.S. customers, but the primary claim deadline of February 17, 2026 has already passed. If you received notice from 23andMe on or after January 5, 2026, you may still have until March 1, 2026 to file. Depending on your situation, you could be eligible for cash payments ranging from approximately $100 for residents of certain states up to $10,000 for documented out-of-pocket losses, plus five years of genetic monitoring services valued at an estimated $1,875.
For example, a California resident who spent $400 on credit monitoring and identity theft protection after the breach could claim both the statutory $100 payment and reimbursement for those expenses. We will walk through the claim process step by step, flag common mistakes that could get your claim denied, and explain what the genetic monitoring benefit actually covers. Whether you are filing a straightforward statutory claim or documenting thousands in extraordinary losses, the information below will help you navigate the process correctly.
Table of Contents
- What Happened in the 23andMe Data Breach and Who Is Eligible for the Settlement?
- How Much Money Can You Actually Get from the 23andMe Settlement?
- The Bankruptcy Factor — Why This Settlement Is Unusual
- How to File Your Claim Step by Step
- Common Mistakes That Could Delay or Sink Your Claim
- What Does the Genetic Monitoring Benefit Actually Include?
- What Happens After You File and What to Expect Going Forward
- Frequently Asked Questions
What Happened in the 23andMe Data Breach and Who Is Eligible for the Settlement?
In October 2023, 23andme disclosed that attackers had used a technique called credential stuffing — essentially trying username and password combinations stolen from other breached websites — to break into customer accounts. Roughly 14,000 accounts were directly compromised, which sounds modest against a user base of 14 million. But the real damage came from 23andMe’s DNA Relatives and Family Tree features, which allowed attackers to pivot from those 14,000 accounts to the personal data of approximately 5.5 million DNA Relatives profiles and 1.4 million Family Tree profiles. In total, about 6.9 million U.S. residents had their information exposed, including names, birth years, relationship labels, percentage of DNA shared with relatives, ancestry reports, and in some cases, health information. The settlement — formally titled *In re: 23andMe, Inc. Customer Data Security Breach Litigation*, Case No.
25-40976 in the U.S. Bankruptcy Court for the Eastern District of Missouri — received final approval from Judge Brian C. Walsh on January 20, 2026. To be eligible, you must have been a 23andMe customer between May 1, 2023 and October 1, 2023, resided in the United States during that period, and received notice from 23andMe that your personal information was compromised. If you never got that notification — whether by email or postal mail — you are likely not part of the settlement class, even if you had an active account. One important distinction: the breach did not necessarily mean someone logged into your specific account. If your data was exposed only because a relative’s account was compromised and you were connected through DNA Relatives, you are still an affected class member as long as 23andMe notified you. This is a point of confusion for many people who assume they were not impacted because their own login credentials were never stolen.
How Much Money Can You Actually Get from the 23andMe Settlement?
The settlement fund totals $30 million, though some sources reference a revised $50 million proposal that surfaced during 23andMe’s bankruptcy proceedings. Compensation breaks down into three distinct cash tiers plus a monitoring benefit. Extraordinary claims allow reimbursement of up to $10,000 for documented, unreimbursed out-of-pocket costs directly tied to the breach — think identity theft repair costs, credit monitoring subscriptions you purchased, security systems, or even mental health treatment related to the anxiety of having your genetic data exposed. Health information claims pay up to $165 if 23andMe specifically notified you that your health data was among the compromised information. Statutory cash claims pay approximately $100 if you lived in Alaska, California, Illinois, or Oregon during the breach period of May 1 through October 1, 2023, as those states have specific data privacy statutes that provide automatic damages. However, if you are expecting a large payout from a simple claim, it is worth tempering expectations.
With 6.9 million potentially eligible class members drawing from a $30 million fund, per-person payments will likely be modest unless you fall into one of the higher-value categories. The $10,000 ceiling for extraordinary claims is just that — a ceiling. You will need receipts, invoices, or other documentation proving every dollar you claim. Filing for $10,000 without supporting paperwork will not get you $10,000; it will get your claim flagged or denied by the settlement administrator, Kroll. Additionally, all eligible class members — regardless of which cash tier they fall into — can enroll in five years of Privacy and Medical Shield plus Genetic Monitoring, which has an estimated retail value of $1,875. If you are not eligible for any of the cash categories or your cash payment would be minimal, this monitoring benefit may actually be the most valuable part of the settlement for you. It is not an either-or situation; you can claim both cash compensation and the monitoring benefit.
The Bankruptcy Factor — Why This Settlement Is Unusual
23andMe filed for Chapter 11 bankruptcy on March 23, 2025, which injected significant uncertainty into the settlement process. Bankruptcy proceedings can complicate class action settlements because the company’s remaining assets must be divided among all creditors, not just data breach victims. In this case, the settlement was approved within the bankruptcy framework by a bankruptcy judge rather than through a traditional class action court, which is why the case landed in the Eastern District of Missouri’s bankruptcy court rather than a standard federal district court. In July 2025, the TTAM Research Institute — a nonprofit led by 23andMe co-founder Anne Wojcicki — completed its purchase of 23andMe’s assets, including the genetic data of millions of customers. This means your DNA data now sits with a different entity than the one you originally contracted with.
For settlement purposes, the $30 million fund was established before the asset sale closed, so the bankruptcy should not directly reduce your payment. But it does mean that 23andMe as you knew it no longer exists as an independent company, and any future privacy concerns about your genetic data will involve TTAM Research Institute rather than the original 23andMe. This bankruptcy context matters for one practical reason: there is no second bite at this apple. If you opt out of the settlement hoping to sue 23andMe independently for a larger payout, you would be filing a claim against a bankrupt entity. The chances of recovering more through individual litigation than through this settlement are extremely slim for most affected customers.
How to File Your Claim Step by Step
Filing can be done online at 23andmedatasettlement.com or by mailing a physical claim form. The online process is faster and provides instant confirmation. You will need your notice ID, which appeared on the settlement notification you received from 23andMe or Kroll. If you cannot find your notice ID, the settlement website has a lookup tool that can help you locate your claim information using your email address. For statutory claims — the approximately $100 payment for Alaska, California, Illinois, or Oregon residents — and for health information claims of up to $165, the process is relatively straightforward. You select the applicable category, confirm your eligibility, and submit.
No extensive documentation is required beyond establishing that you lived in a qualifying state or that 23andMe notified you about health data exposure. For extraordinary claims, however, you must attach documentation of every expense. This means credit card statements showing monitoring service purchases, invoices from identity theft repair services, receipts for security software, or records of mental health treatment costs. The stronger your documentation, the better your chances of receiving the full amount you claim. One tradeoff to consider: if your documented extraordinary expenses are under $100 and you happen to live in a qualifying state, the statutory claim might actually net you a similar or higher payment with far less paperwork. It is worth calculating which category gives you the best return for the effort involved. You can file under multiple categories if you qualify for each, but you should not claim the same expense under two different tiers.
Common Mistakes That Could Delay or Sink Your Claim
The most frequent error is missing the deadline entirely. The primary deadline of February 17, 2026 — requiring online submission by 11:59 PM Central Time or a mailed form postmarked by that date — has already passed for most claimants. The only exception is the extended deadline of March 1, 2026, which applies solely to individuals who first received their settlement notice on January 5, 2026. If you fall into that group, do not wait until the last day to submit. Server traffic spikes near deadlines can cause timeouts and submission errors, and “the website was slow” is not an accepted excuse for a late filing. Another common mistake is filing an extraordinary claim without adequate documentation. Kroll, the settlement administrator, will review these claims and has the authority to reduce or reject them.
Stating that you spent $2,000 on identity protection without attaching a single receipt will almost certainly result in a denial. Even rough documentation — a bank statement highlighting the charge, a confirmation email from a monitoring service — is better than nothing. Mental health treatment claims are particularly documentation-heavy; you will generally need records from a licensed provider showing treatment dates and costs. Finally, be aware that the objection and opt-out deadline was December 29, 2025, and it has passed. You cannot opt out of the settlement at this point. If you were considering individual litigation, that window has closed. Your remaining options are to file a claim and receive your share, or to do nothing and receive nothing. There is no downside to filing if you are eligible.
What Does the Genetic Monitoring Benefit Actually Include?
The five years of Privacy and Medical Shield plus Genetic Monitoring — valued at an estimated $1,875 — covers surveillance of your genetic and personal health data across dark web databases and data broker platforms. If your genetic information appears in an unauthorized context, you will be alerted. For example, if someone attempts to use your compromised health data to fraudulently obtain insurance or medical services, the monitoring service should flag that activity.
This is a relatively new category of monitoring that goes beyond traditional credit monitoring, reflecting the unique nature of genetic data — unlike a credit card number, you cannot change your DNA. To enroll, you select the monitoring option when filing your claim. You can claim this benefit alongside any cash payment you are eligible for. Given that the retail value exceeds what most claimants will receive in cash, this benefit is arguably the most substantive form of compensation for the majority of class members, especially those without documented out-of-pocket losses.
What Happens After You File and What to Expect Going Forward
After submitting your claim, Kroll will review it for completeness and eligibility. Processing timelines in large class action settlements typically run several months after the claim deadline closes. You should receive a confirmation email or letter acknowledging your submission, and eventual payment will come either by check or electronic transfer depending on the option you selected when filing. The exact per-person amounts will not be finalized until Kroll tallies all valid claims against the $30 million fund.
Looking ahead, the 23andMe breach has reshaped the conversation around genetic data privacy. The fact that credential stuffing — a relatively unsophisticated attack method — exposed the genetic information of nearly 7 million people has prompted calls for stronger default security settings on platforms that handle biometric and genetic data. For consumers, the takeaway extends beyond this settlement: if you use any genetic testing service, enable two-factor authentication, use a unique password, and review what data-sharing features are active on your account. The 23andMe breach was not caused by a sophisticated hack — it was caused by password reuse, and that is a problem every internet user can address today.
Frequently Asked Questions
I had a 23andMe account but never got a settlement notice. Can I still file a claim?
Eligibility requires that 23andMe notified you that your data was compromised. If you did not receive a notice, you were likely not identified as an affected user. You can check the settlement website at 23andmedatasettlement.com to look up your eligibility, but without a notification from 23andMe, your claim is unlikely to be accepted.
Can I file for both the statutory cash payment and the genetic monitoring benefit?
Yes. The compensation categories are not mutually exclusive. If you lived in Alaska, California, Illinois, or Oregon during the breach period, you can claim the approximately $100 statutory payment, any applicable health information or extraordinary expense payments, and the five-year genetic monitoring benefit all in the same claim.
I spent money on credit monitoring after the breach but lost the receipts. Should I still file an extraordinary claim?
You should still file, but focus on recovering whatever documentation you can. Bank or credit card statements showing the charges, confirmation emails, or account records from the monitoring service can all serve as supporting evidence. If you truly have no documentation, you may want to rely on the statutory or health information claim tiers instead, as extraordinary claims without supporting paperwork face a high risk of denial.
Is the $30 million settlement fund the final amount, or could it increase?
Some reports referenced a revised $50 million proposal during 23andMe’s bankruptcy proceedings, but the settlement approved by Judge Walsh on January 20, 2026 was for $30 million. The final per-person payouts will depend on how many valid claims are submitted against that fund.
What happens to my genetic data now that 23andMe went bankrupt?
In July 2025, the TTAM Research Institute, a nonprofit led by 23andMe co-founder Anne Wojcicki, acquired 23andMe’s assets, including customer genetic data. Your data is now held by this entity. If you want your data deleted, you should contact the current data holder directly, as the settlement itself does not mandate deletion of genetic records.
The February 17 deadline passed and I did not file. Is there any recourse?
Only if you first received your settlement notice on January 5, 2026 — in that case, you have until March 1, 2026 to file. Otherwise, the deadline has passed and late claims are generally not accepted in class action settlements. Doing nothing means you forfeit your right to any payment or monitoring benefit from this settlement.
You Might Also Like
- Everything To Know About The Capital Health Data Breach Settlement Before You Submit A Claim
- Everything To Know About The SiriusXM Robocall And Telemarketing Settlement Before You Submit A Claim
- Is The 23andMe Customer Data Security Breach Settlement Legit, And How Do You Check Eligibility