23andMe reaches Canadian settlement in data breach class action lawsuit

Genetics data company 23andMe has reached a settlement with plaintiffs in a Canadian class action lawsuit over a 2023 data breach, the law firm behind the suit says.

In October 2023, 23andMe identified and disclosed a massive data breach affecting seven million customers worldwide, among them nearly 320,000 Canadians.

In October 2023 and September 2024, class actions were filed in the British Columbia Supreme Court on behalf of 23andMe’s Canadian customers, and later certified by the court.

“The Plaintiffs and 23andMe have reached a settlement as part of 23andMe’s insolvency proceedings,” the law firm KND Complex Litigation said in a statement Wednesday.

The settlement still needs to be approved by the courts.

The company filed for bankruptcy in the United States in March after struggling with the fallout of a data breach and weak demand for its ancestry testing kits.

The proposed Canadian settlement covers anyone who was a 23andMe customer between May 1 and Oct. 1, 2023, lived in Canada during that window and received a notice from 23andMe notifying them that their personal information was compromised in the data breach.

“The settlement remains subject to approval by the courts in the United States and Canada,” said Sage Nematollahi, the lead Canadian lawyer on the class action lawsuit.

The total proposed settlement involves a payout of $4.49 million (US$3.25 million).

The settlement website said customers may be eligible for a reimbursement of up to $2,500 “for specific documented, unreimbursed, out-of-pocket expenses incurred a direct result of, and in response to, the Cyber Security Incident.”

However, the cheques aren’t coming in just yet. The next steps for anyone expecting compensation is to “do nothing,” the website adds.

The United States Bankruptcy Court will hear an application for final approval of the proposed Canadian settlement on Feb. 17, 2026, to be followed by an application for final approval by Canadian courts.

Trending Now

“Assuming that the court in the United States approves the settlement, it will have to come back and get in front of the Supreme Court of British Columbia for approval of the settlement on the Canadian side as well,” Nematollahi said.

Approval by courts will be followed by a claims process, Nematollahi said, adding that potential claimants can check the settlement website for updates and information.

Anyone who objects to the settlement — for example, individuals who plan to pursue private litigation — can fill out an opt-out form and send it before Jan. 2, 2026.

In June, Canadian Privacy Commissioner Philippe Dufresne and U.K. Information Commissioner John Edwards released the results of their joint investigation, which found 23andMe had “inadequate” security systems and was “slow to respond” to warning signs that customers’ sensitive data was at risk before the “profoundly damaging” 2023 data breach.

The investigation found that of the almost seven million people impacted worldwide, nearly 320,000 Canadians and more than 150,000 people in the U.K. had their sensitive genetic information compromised by hackers.

Dufresne said the breach serves as a “cautionary tale” for all organizations about the importance of data protection.

The U.K. information commissioner levied a 2.31 million-pound fine against 23andMe.

–with files from Global’s Sean Previl