---
title: "23andMe’s $46.75 Million Data Breach Settlement: How Bankruptcy Could Not Shield the Company from Privacy Liability"
description: What does 23andMe’s data breach settlement reveal about bankruptcy and privacy liability? Lipresti Law examines the implications for businesses.
image: https://liprestilaw.com/hubfs/23andMe%20bankruptcy-1.png
---

[Skip to content](https://liprestilaw.com/the-firm-connection/23andme#main-content)

[![Lipresti Law](https://liprestilaw.com/hs-fs/hubfs/logo-3.png?width=207&height=50&name=logo-3.png)](https://liprestilaw.com/)

- [Home](https://liprestilaw.com/)
- [Attorneys](https://liprestilaw.com/meet-our-team)
- [Careers](https://liprestilaw.com/employment)
- Practice Areas
  
  Show submenu for Practice Areas 
  
    - [Banking/Financing](https://liprestilaw.com/banking-financing)
    - [Bankruptcy](https://liprestilaw.com/bankruptcy)
    - [Capital Markets / Securities](https://liprestilaw.com/capital-markets-securities)
    - [Commercial Real Estate](https://liprestilaw.com/commercial-real-estate)
    - [Corporate/Outside General Counsel Services](https://liprestilaw.com/corporate-outside-general-counsel-services)
    - [Healthcare](https://liprestilaw.com/healthcare)
    - [Intellectual Property](https://liprestilaw.com/intellectual-property)
    - [Mergers & Acquisitions](https://liprestilaw.com/mergers-acquisitions)
    - [Nonprofits](https://liprestilaw.com/nonprofits)
    - [Technology Law](https://liprestilaw.com/technology-law)
- [Blog](https://liprestilaw.com/the-firm-connection)
- [Contact](https://liprestilaw.com/contact)
  
  Show submenu for Contact 
  
    - [Careers](https://liprestilaw.com/employment)

Open main navigation

Close main navigation

- [Home](https://liprestilaw.com/)
- [Attorneys](https://liprestilaw.com/meet-our-team)
- [Careers](https://liprestilaw.com/employment)
- Practice Areas
  
  Show submenu for Practice Areas 
  
    - [Banking/Financing](https://liprestilaw.com/banking-financing)
    - [Bankruptcy](https://liprestilaw.com/bankruptcy)
    - [Capital Markets / Securities](https://liprestilaw.com/capital-markets-securities)
    - [Commercial Real Estate](https://liprestilaw.com/commercial-real-estate)
    - [Corporate/Outside General Counsel Services](https://liprestilaw.com/corporate-outside-general-counsel-services)
    - [Healthcare](https://liprestilaw.com/healthcare)
    - [Intellectual Property](https://liprestilaw.com/intellectual-property)
    - [Mergers & Acquisitions](https://liprestilaw.com/mergers-acquisitions)
    - [Nonprofits](https://liprestilaw.com/nonprofits)
    - [Technology Law](https://liprestilaw.com/technology-law)
- [Blog](https://liprestilaw.com/the-firm-connection)
- [Contact](https://liprestilaw.com/contact)
  
  Show submenu for Contact 
  
    - [Careers](https://liprestilaw.com/employment)

 October 5, 2026

# 23andMe’s $46.75 Million Data Breach Settlement: How Bankruptcy Could Not Shield the Company from Privacy Liability

![Picture of Joseph Butler, Esq.](https://liprestilaw.com/hs-fs/hubfs/Joseph-13.jpeg?width=50&name=Joseph-13.jpeg) [Joseph Butler, Esq.](https://liprestilaw.com/the-firm-connection/author/joseph-butler-esq)

Share: [facebook-f icon](http://www.facebook.com/share.php?u=https://liprestilaw.com/the-firm-connection/23andme) [linkedin-in icon](http://www.linkedin.com/shareArticle?mini=true&url=https://liprestilaw.com/the-firm-connection/23andme) [Twitter icon](https://twitter.com/intent/tweet?url=https://liprestilaw.com/the-firm-connection/23andme) [pinterest-p icon](http://pinterest.com/pin/create/link/?url=https://liprestilaw.com/the-firm-connection/23andme) [envelope icon](mailto:?body=https://liprestilaw.com/the-firm-connection/23andme)

When a company files for bankruptcy, its legal liabilities do not simply disappear. Chapter 11 can compromise, discharge, or channel claims through a confirmed plan, and it can materially limit the amount claimants ultimately recover. At the same time, existing claims still must be identified and addressed, and some governmental efforts to obtain nonmonetary relief may continue. The result depends on the nature of the claim and the terms of the court-approved sale, settlement, and Chapter 11 plan.

- *23andMe’s bankruptcy did not eliminate privacy claims, but it changed how and how much claimants could recover*
- *The $46.75 million consumer settlement shows how data-breach liabilities can remain significant in Chapter 11*
- *Sensitive customer data can complicate bankruptcy sales and impose continuing obligations on buyers*
- *Government regulators may still pursue nonmonetary remedies even when a bankruptcy plan limits monetary claims*
- *Cybersecurity failures can affect enterprise value, deal structure, creditor recoveries, and post-closing risk*

The bankruptcy of genetic-testing company 23andMe illustrates that nuance. In July 2026, the U.S. Bankruptcy Court for the Eastern District of Missouri approved a final settlement amount of $46.75 million for a class of U.S. consumers affected by the company’s 2023 data breach. The settlement shows both sides of the bankruptcy process: privacy claims remained a central part of the case, but they were resolved collectively and subject to the economics and binding effect of the confirmed plan.

### **A Data Breach with Lasting Consequences**

The 2023 cyberattack affected approximately 6.9 million customers worldwide. The court-approved settlement covers approximately 6.4 million U.S. residents whose personal information was compromised. According to California’s Attorney General, the attack began when a threat actor used credentials obtained from earlier breaches to access roughly 14,000 customer accounts and then exploited the DNA Relatives feature to obtain information concerning millions of additional customers. The compromised information varied by individual and included personal, ancestry, family-tree, relationship, geographic, and, in some cases, genetic information.

Unlike a password or payment card number, genetic and ancestry information cannot simply be reset or replaced. That feature magnified the privacy concerns surrounding both the breach and the later transfer of 23andMe’s business and customer data in bankruptcy.

The class litigation was initially consolidated in federal court in California and later became part of the bankruptcy proceedings. The Bankruptcy Court granted final approval of the settlement on January 30, 2026, and approved the final $46.75 million amount on July 7, 2026. The deadline for class members to submit claims was February 17, 2026. The settlement administrator stated that payments were expected to be distributed in September 2026. As with most class settlements, the agreement resolves disputed claims and is not a judicial finding that 23andMe violated the law.

### **Chapter 11 Addressed - but Also Limited - Privacy Claims**

223andMe and related entities filed for Chapter 11 protection in March 2025. Through a court-supervised sale, TTAM Research Institute - a nonprofit public-benefit corporation founded and led by 23andMe co-founder Anne Wojcicki - acquired all of the operating assets substantially for an aggregate purchase price of $305 million. The legacy debtor entities later adopted the name Chrome Holding Co.

The distinction matters. The operating assets and ongoing business transferred to TTAM, while the bankruptcy estate and its plan-administration trust addressed legacy claims. In July 2026, the court authorized payment of the remaining $32.46 million of the consumer settlement, in addition to $14.29 million previously disbursed, bringing the total to $46.75 million.

The case therefore should not be described as proof that bankruptcy offers no protection from privacy liability. A more accurate lesson is that Chapter 11 provides a forum for valuing, compromising, and resolving those liabilities. Claimants may receive substantial relief, but the process can also cap recoveries and bar later efforts to pursue monetary remedies outside the plan.

The multistate resolution reached by 42 attorneys general illustrates the point. The states received $150 million in allowed bankruptcy claims arising from the breach, but the actual recovery was limited to $18 million because of the finite funds available in the estate and competing claims. Bankruptcy did not make the asserted liabilities irrelevant; it determined how, and to what extent, they would be paid.

### **Consumer Data Can Reshape a Bankruptcy Sale**

Customer data is not an ordinary asset. When a debtor seeks to transfer sensitive personal or genetic information, the sale may implicate the debtor’s privacy policy, federal bankruptcy provisions governing personally identifiable information, state privacy statutes, regulatory authority, and broader public-policy concerns. Those issues can affect the sale process, the universe of qualified buyers, the obligations imposed on a purchaser, and the value of the assets.

Privacy concerns received unusual attention in the 23andMe case. The Federal Trade Commission cautioned that any transfer should honor the company’s privacy promises. The sale terms and related state resolution included ongoing privacy and data-security protections, continued consumer deletion rights, compliance with applicable privacy laws, risk assessments, and an independent advisory board. These obligations followed the business and affected how TTAM could use and protect the acquired data.

For purchasers in distressed transactions, the practical lesson is that customer data carries both value and risk. Due diligence should address the provenance of the data, the consents and privacy promises governing it, known incidents, pending claims, regulatory inquiries, security controls, deletion obligations, and the buyer's ability to comply with restrictions imposed by the sale order or applicable law.

### **Regulatory Challenges Continue**

California's post-confirmation enforcement action further demonstrates why broad statements about bankruptcy and regulatory liability can be misleading. In May 2026, California’s Attorney General sued Chrome Holding Co., formerly known as 23andMe, alleging failures to maintain reasonable security and misleading statements about the breach. Those remain allegations, and the debtor has denied wrongdoing in the class litigation.

In July 2026, however, the Bankruptcy Court ruled that the confirmed Chapter 11 plan barred California from seeking monetary relief against the former 23andMe entities on those claims. The court permitted California to pursue nonmonetary remedies. That ruling underscores the central distinction: governmental police and regulatory powers may survive in important respects, while claims for money can still be discharged, compromised, or otherwise limited through bankruptcy.

A significant cybersecurity incident may nevertheless create exposure on several fronts, including:

- Consumer class-action and individual claims;
- State and federal regulatory investigations or enforcement actions;
- Contractual, indemnification, and commercial claims;
- Claims by business partners, employees, or other affected parties; and
- Bankruptcy claims asserted by consumers, governments, and other stakeholders.

### **Why This Case Matters Beyond 23andMe**

The 23andMe proceedings show that cybersecurity is a corporate-governance and transactional issue, not merely an information-technology concern. An unresolved incident can reduce enterprise value, increase transaction costs, complicate diligence, narrow the field of potential buyers, and produce continuing obligations that affect the post-closing business.

For a distressed company, privacy liabilities can influence creditor recoveries, plan negotiations, the structure of an asset sale, and the feasibility of a reorganization. For a buyer, the legal analysis must separate liabilities that remain with the estate from obligations that attach to the acquired assets, the transferred data, or the buyer’s future conduct. A section 363 sale order is important, but it is not a substitute for privacy and cybersecurity diligence.

### **Takeaway for Businesses**

The most accurate takeaway is not that Chapter 11 leaves privacy claims untouched, or that it automatically erases them. Bankruptcy changes the forum, leverage, remedies, and economics through which those claims are resolved. In 23andMe’s case, consumers and states obtained meaningful settlements and the purchaser accepted significant privacy protections, while the confirmed plan also limited recoveries and barred certain monetary relief.

Businesses that collect sensitive information should treat cybersecurity governance and privacy compliance as core components of enterprise risk management. Effective controls, accurate public statements, incident-response planning, and well-documented data practices can protect customers and materially affect a company's value, strategic options, and ability to navigate a sale or restructuring after an incident.

***Joseph Butler, Esq.** focuses on bankruptcy, insolvency, and commercial litigation at Lipresti Law. He represents businesses and individuals as both debtors and creditors and has served as a Chapter 7 trustee for the U.S. Bankruptcy Court for the District of Massachusetts since 1987.*

linkedin-in icon

---

[![Lipresti Law](https://liprestilaw.com/hs-fs/hubfs/logo-3.png?width=207&height=50&name=logo-3.png "Lipresti Law")](https://liprestilaw.com/)

Copyright © 2023

linkedin-in icon

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Joseph Butler, Esq.",
    "url" : "https://liprestilaw.com/the-firm-connection/author/joseph-butler-esq"
  },
  "dateModified" : "2026-10-06T03:00:19.737Z",
  "datePublished" : "2026-10-06T03:00:19.000Z",
  "headline" : "23andMe’s $46.75 Million Data Breach Settlement: How Bankruptcy Could Not Shield the Company from Privacy Liability",
  "image" : [ "https://liprestilaw.com/hubfs/23andMe%20bankruptcy-1.png" ],
  "mainEntityOfPage" : {
    "@id" : "https://liprestilaw.com/the-firm-connection/23andme",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://liprestilaw.com/hubfs/logo-3.png"
    }
  }
}
```