Bloomberg / Getty Images
If you’ve ever used the popular DNA testing service 23andMe, you might be in line for a major payday from a class-action lawsuit.
Last fall, the company revealed that it suffered a data breach affecting millions of users. Depending on how much damage you incurred in the incident, you could be eligible for a payment of up to $10,000.
Also: How to delete your 23andMe data and why you should do it now
Here’s what happened, how to know if the lawsuit affects you, and how you can file a claim.
What happened with the 23andMe data breach?
The attackers used a technique known as credential stuffing, where they took a list of stolen credentials and attempted logins across many services until they found a match, hoping people had reused account information.
How many people were affected?
23andMe says the attackers accessed around 14,000 accounts. From those accounts, they viewed DNA Relative profiles of 5.5 million people. This information includes display names, relationships to the compromised account, location, ancestor birth locations, birth years, percentage DNA match, and Family Tree profiles of 1.4 million people (which includes limited account information).
Overall, nearly 7 million people had their information exposed.
Also: Have a genealogy mystery? How I used AI to solve a family puzzle
In response, 23andMe notified affected customers, requiring all users to change their passwords and enable two-factor authentication.
The lawsuit alleges that 23andMe didn’t do enough to protect customer data and that the company didn’t notify customers with Chinese or Ashkenazi Jewish ancestry that their information was specifically targeted and spread across the dark web.
How to file a claim in the 23andMe settlement
To qualify for a settlement payment, you must have been a US resident on Aug. 11, 2023, and must have suffered a hardship directly related to this incident.
The maximum payment offered will be $10,000, and that’s only for extraordinary claims, such as having false tax returns filed, having your identity stolen in other ways, needing to purchase upgraded security systems because you were threatened, or needing mental health treatment as a result of harassment.
Also: T-Mobile’s data breach settlement payments are finally rolling out – how to see if you qualify
If you’re a resident of Alaska, California, Illinois, or Oregon, you may be in line for a payment of around $100, no matter how much you suffered. These states have strict privacy laws and punishments for violations.
You can get details about how to file a claim at 23andMe’s Settlement Claims Portal hosted on Kroll. The deadline is July 14.
Get the morning’s top stories in your inbox each day with our Tech Today newsletter.
