23andMe To Pay Up To $10,000 To Data Breach Victims—Are You Eligible?

If you were affected by the recent 23andMe data breach, you may be eligible for compensation through a $30 million settlement. Here’s what you need to know about the available payouts and how to file a claim.

The 2023 Data Breach: A Recap

In October 2023, 23andMe revealed that approximately 14,000 customer accounts were accessed without authorization . The attackers exploited a "credential stuffing" technique, using login credentials stolen from other websites to gain access to 23andMe accounts.

While the company's systems weren't directly breached, the incident exposed sensitive personal information, including names, birth years, ancestry data, and information shared through the "DNA Relatives" feature.

Potential Payouts for Affected Customers

The settlement provides for three main types of compensation, with a maximum payout of up to $10,000 for specific claims:

• Extraordinary Claims: Customers who experienced significant losses, such as identity theft or incurred costs for security services, may qualify for up to $10,000. According to HIPAA Journal and Tech.co, affected individuals in this category must provide documentation, such as receipts or records of related expenses. The category is capped at $5 million in total, meaning payouts may be prorated if there are numerous claims exceeding this cap​.
• Health Information Claims: Customers whose sensitive health information was specifically exposed can claim around $100. This category includes health information compromised as part of the data breach and is limited to $750,000 across all claimants.
• Statutory Cash Claims: Residents of California, Illinois, Oregon and Alaska are eligible for a general compensation amount, expected to be about $100, if they received a breach notification and can confirm residency in one of these states.

These amounts may vary based on the number of claims and total settlement funds available, especially since claims will be processed on a proportional basis if demand is high.

How to Submit a Claim

To submit a claim, you’ll need to visit the official 23andMe settlement website when it becomes available. The site will offer an online claim form and a downloadable PDF version if you prefer to submit by mail.

Remember, if you’re submitting for an extraordinary claim, make sure to include supporting documentation like receipts or records of expenses related to identity protection or financial losses. Once completed, you can mail your form to:

23andMe Settlement Administrator

P.O. Box 301172

Los Angeles, CA 90030-1172

Keep an eye on the deadline to file your claim, as it will be announced once the settlement receives final court approval.

Additional Benefits

All affected customers will also receive three years of security monitoring services, which include monitoring for identity theft and other potential security risks related to their compromised data.

For those affected by the breach, filing a claim is an opportunity to receive some restitution for the misuse of your personal data.

This column originally appeared in Forbes.