How a credential-stuffing attack exposed 6.9M genetic profiles at 23andMe

From a cybersecurity standpoint, the 23andMe incident is a textbook credential-stuffing disaster: attackers exploited reused credentials to access genetic profiles, demonstrating that even low-sophistication attacks can yield high-sensitivity payloads when targeting platforms lacking robust multi-factor authentication enforcement. With 6.9 million records exposed, this breach ranks among the most consequential non-technical intrusions in recent memory.

The recent approval by a U.S. bankruptcy judge of a $46.75 million settlement in the 23andMe data breach case marks a significant milestone in the intersection of genetic data privacy, corporate bankruptcy, and cybersecurity accountability. On July 8, 2026, Judge Brian Walsh of the U.S. Bankruptcy Court for the Eastern District of Missouri deemed the settlement fair and equitable, paving the way for compensation to approximately 6.9 million customers whose sensitive genetic and personal information was exposed in a 2023 cyberattack. The settlement, while substantial, is only one chapter in 23andMe’s broader legal and financial saga, which includes a subsequent bankruptcy filing, asset acquisition by a nonprofit, and an ongoing enforcement action by the California Attorney General.

“

Notably, $14.29 million of this amount had already been distributed prior to the judge’s final approval, leaving a remaining balance of $32.46 million to be paid.

The breach, which occurred in October 2023, was executed via credential stuffing—a technique where attackers use usernames and passwords previously compromised in other data breaches to gain unauthorized access to accounts on a target site. Because many users reuse credentials across services, the attack on 23andMe was alarmingly effective: hackers not only accessed individual accounts but also leveraged the company’s "DNA Relatives" feature, which allows customers to opt into sharing genetic data with others, to scrape a far larger pool of data. This exposure of 6.9 million individuals’ genetic profiles, ancestry reports, and health information represented one of the largest biometric data breaches in history, triggering intense scrutiny from regulators, lawmakers, and the public.

In the wake of the breach, 23andMe faced a wave of class-action litigation, as well as declining consumer confidence and increased competition. These pressures, combined with a pre-existing slump in demand for direct-to-consumer genetic testing, culminated in the company’s March 2025 Chapter 11 bankruptcy filing. The bankruptcy was a strategic move to reorganize liabilities and shield the company from the growing litigation costs. Later in 2025, a nonprofit entity led by co-founder and former CEO Anne Wojcicki acquired 23andMe’s assets out of bankruptcy, effectively transitioning the company into a new structure aimed at continuing its genetic research mission, but under a different ownership model.

The $46.75 million settlement, approved under the bankruptcy plan, draws from a trust established for the benefit of breach victims. Notably, $14.29 million of this amount had already been distributed prior to the judge’s final approval, leaving a remaining balance of $32.46 million to be paid. The distribution mechanism and per-claimant allocations remain under the purview of the bankruptcy administrator, but legal experts note that such mass tort settlements in bankruptcy often result in modest individual payouts given the large class size. The judge’s ruling emphasized that the settlement was in the best interest of the trust, sidestepping the potentially prolonged and costly appeals that could have ensued from objectors.

While this civil settlement provides a degree of closure, 23andMe’s legal challenges are far from over. California Attorney General Rob Bonta has filed a separate lawsuit, alleging that the company failed to adequately safeguard customer data and misled consumers about the severity of the breach. Bonta’s action seeks civil penalties that could amount to millions of dollars, and unlike the class-action settlement, is not subject to the bankruptcy court’s approval. This parallel enforcement underscores a growing trend of state regulators stepping in where federal agencies or class actions may not fully address data protection failures, especially when genetic information—considered uniquely sensitive and immutable—is at stake.