23andMe Pays $47 Million to Resolve Genetic Data Breach Affecting 6.9 Million Customers
Won by CaseyGerry.
Gayle Blatt of CaseyGerry served as court-appointed co-lead counsel in a multidistrict proceeding against 23andMe, securing a $46.75 million settlement for approximately 6.9 million customers whose genetic ancestry profiles and personal data were stolen in a 2023 credential-stuffing attack.
What happened
Starting around April 2023, attackers used lists of previously exposed usernames and passwords to break into 23andMe accounts through credential stuffing, a technique that exploits people who reuse passwords across different sites. The intrusion went undetected for roughly five months. By the time 23andMe disclosed the breach on October 6, 2023, hackers had accessed DNA Relatives profile data for approximately 5.5 million customers and Family Tree information for an additional 1.4 million, bringing the total to nearly 6.9 million affected accounts.
What made the breach unusually sensitive was the nature of the stolen data. Exposed records included names, dates of birth, geographic locations, family tree details, and genetic information such as maternal and paternal haplogroup results. Some of that data was later offered for sale on the dark web, with subsets targeting specific ethnic communities. Investigators later found that 23andMe had failed to employ basic safeguards against credential stuffing, including password blocklist comparisons, multifactor authentication requirements, and appropriate rate limiting on login attempts.
Plaintiffs' attorneys filed actions across the country, and the Judicial Panel on Multidistrict Litigation consolidated the cases before Judge Edward M. Chen in the Northern District of California as MDL 3:24-md-03098. On June 5, 2024, Judge Chen appointed Gayle M. Blatt of CaseyGerry, Cari Campen Laufenberg of Keller Rohrback, and Norman E. Siegel of Stueve Siegel Hanson to serve as interim co-lead class counsel.
23andMe filed for Chapter 11 bankruptcy in March 2025, complicating the litigation. The case shifted to coordination with the U.S. Bankruptcy Court for the Eastern District of Missouri, where the company's plan administration trust managed the settlement fund. The original class action settlement, preliminarily approved by Judge Chen in December 2024, had grown through negotiations to a maximum of $50 million. After accounting for bankruptcy-related reductions, the final distribution approved by the bankruptcy court on July 6 or 7, 2026 totaled $46.75 million for U.S. data breach claimants, with a separate $3.25 million for Canadian class members.
Over 255,860 claims were resolved as of the time of the distribution order, with individual payouts ranging from $50 up to $10,000 for extraordinary harm claims. Final approval of the underlying class action settlement had been granted on January 30, 2026. The settlement represents one of the largest data breach resolutions involving consumer genetic information in U.S. history.
Sources
This account is drawn from contemporaneous public reporting and the court record.
More proven verdicts from CaseyGerry
All CaseyGerry proven verdicts →In multidistrict litigation before Judge Andrew J. Guilford, CaseyGerry served as class counsel in a $393.5 million settlement resolving allegations that Wells Fargo secretly loaded unnecessary collateral protection insurance onto auto loan accounts, pushing hundreds of thousands of borrowers into delinquency and causing roughly 27,000 wrongful vehicle repossessions.
As court-appointed lead plaintiffs' counsel, Morgan & Morgan's John Yanchunis negotiated the $117.5 million settlement resolving claims from Yahoo's 2013-2016 data breaches, the largest theft of personal data in history, touching roughly 3 billion accounts worldwide. Judge Lucy Koh approved the fund in 2020 after rejecting an earlier version as inadequate.
Gayle Blatt of Casey Gerry served on the plaintiffs' leadership committee in the consolidated MDL arising from the 2011 hack of Sony's PlayStation Network, which exposed the personal data of approximately 77 million accounts, resulting in a $15 million class settlement.
A Navy veteran lost his right leg and the use of his arm after a Navy-operated van triggered a chain-reaction crash on Interstate 5; CaseyGerry secured a $10.8 million settlement, described as the largest federal vehicle-collision settlement in San Diego history.
Related class action verdicts
John Eddie Williams, Jr. served as one of five private attorneys retained by the State of Texas to sue the major tobacco companies, producing a $15.3 billion settlement in January 1998, the largest single-case settlement in U.S. history at the time.
As court-appointed co-lead plaintiffs' counsel in AFFF MDL 2873, Paul J. Napoli of Napoli Shkolnik negotiated a settlement requiring 3M Company to pay up to $12.5 billion to public water systems contaminated by PFAS compounds in firefighting foam, the largest drinking-water settlement in American legal history.
As court-appointed co-lead counsel in AFFF MDL 2873, Paul J. Napoli of Napoli Shkolnik helped negotiate a $1.185 billion class settlement with DuPont, Chemours, and Corteva to compensate public water systems across the United States for PFAS contamination tied to firefighting foam.