If you’ve ever sent your spit over to 23andMe, you may be eligible for a $2,500 chunk of a $4.5 million class action lawsuit that has been filed against the company.
The proposed settlement has since been reached. Now, affected customers could be able to receive a reimbursement after their data had been exposed.
Data Breach
23andMe is a genetic testing company that offers people a way to discover their family ancestry. They use an at-home saliva collection kit that simply asks customers to spit into a tube and then send it back to the company. Then, they provide you with information on your family ancestry.
In 2023, 23andMe experienced a data breach, exposing almost 7 million of its customers’ highly sensitive data. According to the Privacy Commissioner of Canada and UK Information Commissioner, their joint investigation revealed that 23andMe had issues relating to “security measures to help prevent, detect and respond to a breach.”
“Our investigation found a number of deficiencies in 23andMe’s safeguards that contributed to the breach. Many of these deficiencies stemmed primarily from the fact that 23andMe did not develop appropriate safeguards to prevent credential stuffing, which is a common form of attack.”
Class action lawsuits were filed in the British Columbia Supreme Court in October 2023 and September 2024.
23andMe Class Action Lawsuit
The settlement has been officially approved by U.S. and Canadian courts, with the settlement stating that if you were:
- A customer between May 1, 2023 and October 1, 2023,
- Resided in Canada during this time,
- Received a notice from 23andMe regarding your data being compromised in the breach,
- And did not opt out of the Canadian Data Breach Settlement in accordance with the Court-approved procedure
Then you are eligible for compensation, which comes in two forms. The first type is for extraordinary claims. This is a “reimbursement of up to CA$2,500 for specific documented, unreimbursed, out-of-pocket expenses incurred a direct result of, and in response to, the Cyber Security Incident.”
The second type is for ordinary claims, “a pro-rated share requiring no compensation.”
If you’d like to make a claim, check out the 23andMe proposed Canadian settlement page. You have until end of day on June 25, 2026 to submit an online claim.
