Introduction
The 23andMe bankruptcy matters well beyond one company's finances. The case involves genetic data, a prior data breach, a court-approved asset sale, and several overlapping legal claims.
Many people struggle to separate these events. The 2023 breach and the 2025 Chapter 11 case are distinct. The records do not show that the breach caused the bankruptcy.
This article explains what happened in each, what became of customer data, and where to find authoritative information on claims, eligibility, and payments. BankruptcyData tracks restructuring cases like this one for professionals, and this guide draws on public court, regulator, and administrator records.
Key Takeaways
- Bankruptcy alone doesn't mean new breaches; it raises questions about data ownership and transfer.
- The breach settlement, Canadian settlement, and bankruptcy claims run on separate tracks and deadlines.
- Use only official administrator portals and court notices, never unsolicited payment messages.
- Professionals should monitor the docket to separate confirmed orders from proposals.
What Led to the 23andMe Bankruptcy and What Happened in the Case
Financial decline and leadership change
SEC-reported revenue fell from $299.5 million in fiscal 2023 to $219.6 million in fiscal 2024 and $189.9 million in fiscal 2025, according to SEC company data. Fiscal 2025 net loss was $280.9 million. Those numbers show deterioration, but they don't prove a single cause.
Anne Wojcicki resigned as CEO effective March 23, 2025, and stayed on as a director. Joseph Selsavage became interim CEO.
The Chapter 11 filing
The debtors filed voluntary Chapter 11 petitions on March 23, 2025, in the U.S. Bankruptcy Court for the Eastern District of Missouri, Case No. 25-40976. Chapter 11 is a restructuring and sale process. It is not an immediate shutdown or liquidation. A binding term sheet contemplated up to $35 million in debtor-in-possession financing, subject to court approval.
Bidding and sale
- May 17, 2025: Regeneron was selected at an auction with a $256 million bid.
- June 13, 2025: TTAM Research Institute, a nonprofit, bid $305 million and became the winning bidder.
- June 27, 2025: The bankruptcy court approved the sale.
- July 14, 2025: TTAM announced the closing.
Separate assets
TTAM's announcement says personal genome and research services continued. State attorney general materials describe consumer data as sold to TTAM.
Lemonaid, the telehealth unit, was treated separately in SEC filings: one described a planned sale, a later one a wind-down. Public materials do not indicate it was part of the main TTAM data transaction.
Compact timeline
| Date | Milestone |
|---|---|
| Oct. 1, 2023 | Threat-actor post about stolen data |
| Mar. 23, 2025 | Chapter 11 filing |
| June 27, 2025 | Sale order |
| July 14, 2025 | Sale closing announced |
| Nov. 19, 2025 | Confirmation hearing |
| Dec. 5, 2025 | Plan effective date |
Verify each milestone against the docket, sale order, confirmation order, and plan.
A note for professionals
Restructuring attorneys, distressed investors, advisors, and credit teams can use BankruptcyData to monitor court activity, claims developments, and outcomes. It is a professional research platform, not a consumer claims service.
The 23andMe Data Breach and What Happened to Customer Data
How the breach worked
Attackers used credential stuffing, meaning passwords stolen elsewhere and reused on 23andMe accounts. According to SEC filings, access to those accounts exposed other users' profile information through the DNA Relatives feature. Exposed data included ancestry information and, for a subset, health-related information.
Not all exposed data is identical. Directly accessed accounts, connected-profile exposure, and health data are different categories.
The numbers
- Regulators found access beginning April 29, 2023, lasting about five months, and reaching more than 18,000 accounts directly.
- 23andMe reported nearly 7 million customers affected worldwide.
- The U.S. settlement site cites about 6.4 million U.S. residents.
- Regulators list about 320,000 in Canada and 155,600 in the UK.
The 18,000 figure is a regulatory finding of direct access. The larger counts are company and settlement-site figures.
Regulators in Canada and the UK also found that 23andMe required only eight-character passwords and missed opportunities to stop the attack. The UK ICO fined the company £2.31 million.
Why the bankruptcy raised new concerns
When a buyer acquires 23andMe's assets, those assets include customer databases. Continued use of that data is governed by privacy policies, court orders, regulatory requirements, and consent choices.
TTAM stated it would honor existing privacy statements. Other promises, such as a Consumer Privacy Advisory Board and two years of Experian monitoring, should be treated as announced commitments rather than verified implementation.
What customers can do
- Delete the account, which opts you out of research and discards the sample.
- Withdraw from research participation separately.
- Choose to store or discard samples. Discards can't be reversed.
- Change credentials and use two-step verification.
Deletion has limits. It can't reverse data already disclosed, shared in research, placed in legal records, or retained under a legal preservation requirement.
Oversight
Neil Richards, appointed Consumer Privacy Ombudsman on May 6, 2025, filed his report June 11, 2025. The FTC chairman's letter to 23andMe raised concerns about transferring sensitive genetic data. The court addressed state objections in its sale opinion.
Claims, Settlements, and What Customers Should Do Next
The separate tracks
| Track | Key facts |
|---|---|
| U.S. class settlement | Final approval Jan. 30, 2026; $46.75 million amount approved July 7, 2026 |
| Canadian settlement | $3.25 million gross (about CAD 4.49 million); claims closed June 25, 2026 |
| Chapter 11 proofs of claim | General and cyber-incident deadline July 14, 2025; passed |
| State government settlements | Recoveries for states, not consumer payments |
U.S. class settlement
The class covers U.S. residents who were customers from May 1 through October 1, 2023, and received notice that their information was compromised. Claim deadline was February 17, 2026; the deficiency-cure deadline was June 12, 2026. The settlement site says payments on approved claims were issued September 29-30, 2026.
Benefit categories included up to $10,000 for extraordinary claims, up to $165 for health-information claims, an estimated $100 statutory payment, and five years of monitoring. These are category terms, not guaranteed awards.
Arbitration and overlap
A 2024 court filing said people who filed or threatened arbitration were included in the then-proposed class. Don't treat arbitration as fully independent without checking the final release.
How much will you get?
No one can promise an amount. Payments depend on approved terms, claim category, documentation, available funds, administrative costs, objections, appeals, and approved claim counts.
Texas announced $150 million in settled state claims, while Massachusetts said $18 million would be paid from bankruptcy funds. Those are state recoveries, not a consumer pool. California announced a $6 million settlement on October 19, 2026, subject to court approval.
Verifying a claim
- Go to the official administrator site, not a link from an email.
- Use its claim-status tool.
- Keep your claim number and submission confirmation.
- Review court-approved notices.
- Contact the administrator only through independently verified details.
Never pay a fee or give passwords, banking details, or recovery codes to obtain funds. The Canadian site warns that messages claiming payments have started or asking for banking details are suspicious.
Bankruptcy claims status
The Plan Administration Trust says it is gathering documentation to issue distributions. A docket notice dated October 19, 2026 concerns duplicate claims. A consolidated public count of fraudulent or expunged claims is not readily available.
What the Bankruptcy Means for Privacy and the Broader Legal Landscape
Why genetic data is different
Genetic data can't be changed like a password, and it reveals information about relatives. Bankruptcy law, consumer privacy law, state genetic-privacy statutes, and research-consent rules can all overlap.
- Bankruptcy Code section 363(b)(1): if a privacy policy bars transfer, a sale must be consistent with the policy or follow a court-approved process with notice, a hearing, and a Consumer Privacy Ombudsman.
- California: requires clear, affirmative consent; inaction and dark patterns don't count.
- Illinois: treats genetic testing and information as confidential and privileged.
The bankruptcy estate generally includes all of a debtor's legal and equitable interests in property at filing, which is why data held by the company became a sale question.
HIPAA's limits
HIPAA applies to covered entities (health plans, clearinghouses, and certain providers) and their business associates. A consumer genetics company isn't automatically covered because it holds genetic data; its role matters. The FTC's Health Breach Notification Rule covers certain personal health record vendors outside HIPAA.
Wider implications
Companies holding genetic, health, or biometric data need:
- Clear consent language and strong security controls
- Retention limits and working deletion workflows
- A plan for what happens to data in a sale
The regulators' findings here (an eight-character password policy and missed opportunities to detect the breach) are case-specific, but they show the cost of weak basics.
This article is general information, not legal advice. Customers with documented losses or disputes should consult a qualified attorney or the relevant administrator.
How to Check Whether You Were Affected and Protect Your Information
Verification sequence
- Search your inbox for official breach notices.
- Review your account email and security history.
- Contact 23andMe through a channel you found independently.
- Check the settlement administrator's site.
Protect yourself
- Reset any reused passwords. Current guidance calls for at least 12 characters.
- Use app-based two-step verification.
- Review connected accounts.
- Monitor email and credit activity for phishing or identity theft.
- Keep breach notices and related evidence.
Deletion and opt-outs
Submit deletion, sample-destruction, or research opt-out requests through the current official 23andMe process, and save confirmations. Deleting an account shouldn't be assumed to change settlement eligibility.
Scam warning signs
- Upfront payment demands
- Requests for a full password or recovery code
- Unofficial claims portals
- Pressure to act immediately
- Payment promises with no court notice behind them
Reliable sources
Use the Kroll case portal for bankruptcy claims and docket records. For class-settlement claims, use the court-authorized settlement administrator. Also monitor regulator notices and privacy communications from any successor company.
Frequently Asked Questions
How much will I get from the 23andMe lawsuit?
It depends on the settlement or claim category, eligibility rules, documentation, deductions, and available funds. Ask the official administrator for individualized information.
What is the current status of my 23andMe claim?
Use the official claim-status portal with your claim or confirmation number. Bankruptcy claims and breach-settlement claims may use different systems.
How do I get 23andMe settlement money?
Confirm eligibility, file or validate your claim by the deadline, and wait for an approved distribution. Legitimate processes never charge fees or ask for unofficial payments.
How do I know if I was affected by the 23andMe data breach?
Check official breach communications, account notices, and administrator instructions. Not receiving a notice is no reason to share credentials with an unsolicited caller.
What happened to 23andMe customer data after the bankruptcy sale?
The court approved the sale to TTAM, and state materials describe consumer data as transferred to it. Verify current privacy terms and deletion or research choices through official TTAM and court sources.
Is 23andMe still operating after bankruptcy?
TTAM announced that DNA testing and research continued after the July 14, 2025 acquisition. The former holding company, now Chrome Holding Co., is handled through the Plan Administration Trust for claims.
