The breach, disclosed October 6, 2023, resulted from a credential stuffing attack that exposed profile and ethnicity information. Cybercriminals specifically targeted users of Chinese and Ashkenazi Jewish heritage. The incident affected approximately 6.9 million users globally, including nearly 150,000 New Jersey customers. A multistate settlement led by 42 attorneys general, including New Jersey Attorney General Jennifer Davenport, resolved allegations that 23andMe failed to safeguard privacy and did not adequately notify targeted groups.
23andMe filed Chapter 11 bankruptcy in March 2025, facilitating its acquisition by Chrome Holding and placing breach liability into court-supervised proceedings. The $46.75 million payout includes a $14.29 million credit for previously disbursed funds, resulting in a net additional payout of $32.46 million. The settlement incorporates an earlier $30 million class-action agreement and provides affected users three years of security monitoring through "Privacy Shield."
Attorneys should note the practical timeline: the bankruptcy court finalized the payout July 7, 2026, just before the July 14 claim deadline. Kroll has begun distributing funds immediately. This settlement represents the culmination of state-level enforcement efforts nearly three years after the initial breach and establishes a concrete financial remedy for affected individuals.