Class Actions
23andMe Data Breach Litigation: MDL 3098 and How It Ended
The 23andMe genetic data breach lawsuits were consolidated in MDL No. 3098 and resolved through a bankruptcy settlement. Here is what the record shows.
On this page
Something in this article wrong, out of date, or missing its source? Send the editorial desk a note.
The 23andMe customer data security breach litigation was consolidated in MDL No. 3098 in the Northern District of California before Judge Edward M. Chen. It is no longer pending. On February 18, 2026, Judge Chen granted a stipulated dismissal with prejudice after the parties reported that the bankruptcy court had granted final approval of a class settlement on January 30, 2026. The settlement establishes a fund of between $30 million and $50 million for people who received notice that their information was compromised. No court has found that 23andMe’s security practices were unlawful, and the company denied wrongdoing in the settlement notice.
What the documents say happened
The settlement notice approved by the bankruptcy court states that 23andMe announced a cyberattack on October 6, 2023, which resulted in unauthorized access to personal information concerning approximately 6.4 million United States residents. It says the lawsuit claims 23andMe did not adequately protect users’ personal information, and it records the company’s denial of wrongdoing.
The Judicial Panel on Multidistrict Litigation described the litigation as arising from allegations that 23andMe failed to prevent and mitigate the consequences of a 2023 breach that compromised the personally identifiable and genetic information of “some seven million” customers. The figures come from different documents and measure different populations, so this article reports both.
The court-approved notice says the data included uninterpreted raw genotype data, certain health reports derived from genetic processing, and self-reported health condition information. That is the notice’s description, not a court finding.
The federal consolidation
23andMe itself asked the Panel to centralize the litigation. Its motion, filed December 21, 2023, listed 31 actions in three districts: 29 in the Northern District of California, one in the Central District of California and one in the Northern District of Illinois. The transfer order filed April 11, 2024 records that eight related actions had been identified since the motion, for 39 actions in three districts.
The order describes the common questions as how 23andMe’s system was breached, how and when the breach was identified, what security measures the company had in place, and what it did after discovery. It lists claims for negligence, invasion of privacy, breach of contract, breach of the covenant of good faith and fair dealing, unjust enrichment, and violations of state consumer protection and privacy laws. It assigns the proceeding to Judge Chen, citing that most actions were already before him and that 23andMe was headquartered in the district.
The Panel’s statistics report dated October 1, 2026 still lists MDL No. 3098 with 40 actions pending of 41 filed. The district court docket records the case as terminated on February 18, 2026. This article reports both and does not treat the Panel’s count as current status.
How the case ended
The settlement did not originate in the bankruptcy. The bankruptcy court’s preliminary approval order records that the parties entered a class action settlement agreement on September 5, 2024, and that Judge Chen conditionally granted preliminary approval on December 4, 2024.
On March 23, 2025, 23andMe Holding Co. and affiliated debtors filed chapter 11 petitions in the Eastern District of Missouri, jointly administered as In re Chrome Holding Co. (f/k/a 23andMe Holding Co.), No. 25-40976. The settlement was restructured as a class proof of claim, with a cap of $50 million on aggregate cash distributions and a floor of $30 million below which the debtors reserved no right to contest the claim.
The settlement notice records that the bankruptcy court approved the sale of the companies’ assets to TTAM Research Institute and that the debtors changed their names to Chrome Holding Co. and ChromeCo, Inc. Judge Brian C. Walsh granted preliminary approval of the restructured settlement on October 2, 2025. The parties’ February 2, 2026 status report states that final approval and approval of fees and service awards were granted on January 30, 2026, and that the bankruptcy court retains exclusive jurisdiction over the settlement’s implementation.
What the settlement provides
The class is defined as all natural persons who were United States residents at any time between May 1, 2023 and October 1, 2023 and who received notice from 23andMe that their personal information was compromised. A statutory subclass covers class members who lived in Alaska, Oregon, California or Illinois during that period.
The court-approved notice describes the benefits as five years of Privacy and Medical Shield plus genetic monitoring, reimbursement of up to $10,000 for documented extraordinary expenses, health information claim payments of up to $165, and statutory cash claim payments estimated at $100 for subclass members. If the fund allowed is less than $50 million, those amounts are reduced proportionally, and payments may be adjusted pro rata depending on how many class members participate.
The notice states that the fund also pays administration costs and attorneys’ fees of up to 25 percent, subject to court approval, and that Kroll was authorized as settlement administrator. These are the notice’s terms, not a promise of any individual payment.
What is established vs. what is alleged
Established by the documents reviewed: that 23andMe announced a cyberattack on October 6, 2023; that the Panel created MDL No. 3098 on April 11, 2024 and assigned it to Judge Chen; the claims named in the transfer order; the settlement agreement of September 5, 2024; the chapter 11 filings of March 23, 2025; the preliminary approval of October 2, 2025; the parties’ report that final approval was granted on January 30, 2026; and the dismissal with prejudice entered February 18, 2026.
Alleged, not decided: that 23andMe’s data security was inadequate, that it delayed identifying or disclosing the breach, and that its conduct was negligent, invaded privacy, breached a contract or unjustly enriched it. A settlement resolves those claims without a ruling on their merits.
Not established: any finding that the breach caused a particular person’s loss, any admission of liability, or any verdict.
What this does not establish
A class settlement approved in bankruptcy is not a finding that anyone broke the law. The notice states that 23andMe denies wrongdoing and that no judgment or determination of wrongdoing has been made. The court’s role at final approval is to decide whether the settlement is fair, reasonable and adequate, not to decide the underlying claims.
Membership in the class does not guarantee a payment. The amounts are subject to proportional reduction, and the fund is allocated among several benefit categories. Anyone reading a website that states a per-person payout should check the court record. Our guide to verifying settlement notices describes how. Related coverage includes the MOVEit litigation, the Change Healthcare litigation and the PowerSchool litigation. The class action section collects the rest.
Key dates
- October 6, 2023: 23andMe announces the cyberattack, per the court-approved settlement notice.
- December 21, 2023: 23andMe moves to centralize the litigation.
- April 11, 2024: the Panel creates MDL No. 3098 before Judge Chen.
- September 5, 2024: the parties enter the settlement agreement.
- December 4, 2024: Judge Chen conditionally grants preliminary approval.
- March 23, 2025: the debtors file chapter 11 petitions in the Eastern District of Missouri.
- October 2, 2025: Judge Brian C. Walsh grants preliminary approval of the restructured settlement.
- January 30, 2026: the bankruptcy court grants final approval, as the parties report.
- February 18, 2026: Judge Chen grants the stipulated dismissal with prejudice.
Frequently asked questions
Is the 23andMe data breach lawsuit still active?
No. The docket records the consolidated case, No. 3:24-md-03098-EMC, as terminated on February 18, 2026, when Judge Chen granted a stipulated dismissal with prejudice. The claims were resolved by the bankruptcy settlement, not by a trial.
What is MDL No. 3098?
It was the federal multidistrict proceeding for the 23andMe customer data breach lawsuits, created on April 11, 2024 and assigned to Judge Edward M. Chen in the Northern District of California for coordinated pretrial proceedings.
How much is the settlement?
The court-approved notice describes a fund of between $30 million and $50 million, with five years of monitoring, health information payments of up to $165, statutory claims estimated at $100, and reimbursement of up to $10,000 for documented extraordinary expenses.
Who is included?
Natural persons who were United States residents at any time between May 1, 2023 and October 1, 2023 and who received notice from 23andMe that their personal information was compromised. A statutory subclass covers Alaska, Oregon, California and Illinois residents.
Did 23andMe admit wrongdoing?
No. The settlement notice states that the company denies any wrongdoing and that no judgment or determination of wrongdoing has been made.
Sources
- United States Judicial Panel on Multidistrict Litigation: “Transfer Order, In re: 23andMe, Inc., Customer Data Security Breach Litigation, MDL No. 3098 (filed April 11, 2024)” (link, accessed 2026-10-25)
- United States Judicial Panel on Multidistrict Litigation: “MDL Statistics Report: Distribution of Pending MDL Dockets by Actions Pending (October 1, 2026)” (link, accessed 2026-10-25)
- United States Judicial Panel on Multidistrict Litigation: “Pending MDL Dockets” (link, accessed 2026-10-25)
- United States District Court, Northern District of California (RECAP Archive): “Joint Updated Status Report and [Proposed] Order, No. 3:24-md-03098-EMC (ECF No. 187, filed February 2, 2026)” (link, accessed 2026-10-25)
- United States District Court, Northern District of California (RECAP Archive): “Stipulation of Voluntary Dismissal with Prejudice, No. 3:24-md-03098-EMC (ECF No. 188, filed February 13, 2026)” (link, accessed 2026-10-25)
- United States District Court, Northern District of California (RECAP Archive): “Order Granting Stipulated Dismissal with Prejudice, No. 3:24-md-03098-EMC (ECF No. 189, entered February 18, 2026)” (link, accessed 2026-10-25)
- United States Bankruptcy Court, Eastern District of Missouri (RECAP Archive): “Order Preliminarily Approving the U.S. Data Breach Settlement Agreement, In re Chrome Holding Co. (f/k/a 23andMe Holding Co.), No. 25-40976 (Bankr. E.D. Mo., Doc. 1450, filed October 2, 2025)” (link, accessed 2026-10-25)
Collective Claim publishes general legal information. This article is not legal advice and does not create an attorney–client relationship. Court records and agency actions change; verify current status with the court or agency before relying on it.