‘The company failed to implement basic defenses’: 23andMe data breach victims are finally getting paid, but bankruptcy could shrink their payouts

State investigators accused 23andMe of failing to address the issue and promoting the idea that customers were responsible for the breach.

“23andMe learned about the breach months after impacted personal information was publicly available,” the Delaware Department of Justice stated in a media release. “They first denied a breach before later confirming it and then blaming consumers for how their accounts were set up or how passwords were used.”

For 23andMe victims, it’s all in the family

Data security experts say the 23andMe case stands out because it involved genetic information in addition to the usual data exposed in cyber breaches, such as names, dates of birth, contact information and Social Security numbers.

Unlike a stolen credit card number, genetic information is permanent. You can’t change your DNA, and the multi-state investigation focused heavily on that concern.

“Courts and federal and state governments should treat genetic data breaches much more distinctly than financial data breaches,” Larry Huttman, a personal injury litigation attorney at Florida-based law firm Farah & Farah, told Moneywise. “However, non-economic damages are always subject to non-objective measurement.”

In legal cases, damages involving biometric data don’t easily translate into dollar amounts. Genetic information can be priceless, and the impact of a breach can vary significantly from person to person.

“However, these attorneys general were making claims on behalf of the states, not the individuals, so class action compensation is not well designed to address these areas,” Huttman said.

Cybersecurity experts agree, noting that consumers cannot change their DNA the way they can cancel a stolen credit card or reset a password.

“It reveals lifelong health and insurance-related risks, ancestry details, and family connections without the consent of relatives,” digital identity protection expert Raj Ananthanpillai told Moneywise.

That creates unique risks that can last for generations. Settlement amounts, like those in the 23andMe case, may not fully reflect those lifelong harms, while bankruptcy proceedings can further reduce what victims ultimately receive.

“Stronger remedies such as higher statutory damages, mandatory impact assessments, and dedicated victim funds are needed to match the irreversible nature of the breach and provide fairer compensation,” Ananthanpillai said.

Unique inefficiencies mar the 23andMe case

The 23andMe breach may eventually be viewed as more than an isolated failure. Instead, it highlights broader weaknesses in how consumer DNA testing companies manage and protect highly sensitive information.

“The company failed to implement basic defenses against well-known threats such as credential stuffing despite the extraordinarily personal nature of the data involved,” Ananthanpillai said.