Loading story…
23andMe, now operating as Chrome Holding, has secured a $16.5 million settlement from its cyber insurers as part of its Chapter 11 bankruptcy proceedings. The agreement involves the insurers buying back unused cyber insurance coverage, with the funds earmarked to pay creditors whose claims are covered by the company's cyber policies, including those related to ongoing cyberattack litigation. The settlement also stipulates that Chrome will indemnify the insurers for claims up to the settlement amount and release them from further obligations related to the policies.
The bankruptcy court approved the settlement, which is part of a broader restructuring that included the sale of 23andMe's Personal Genome Service and Research Services business lines to TTAM Research Institute for $305 million. Under TTAM's ownership, 23andMe continues to provide DNA health and ancestry testing services. The settlement provides a mechanism for addressing outstanding cyber-related claims as the company navigates its financial and legal challenges.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
During Chapter 11 proceedings, bankrupt 23andMe Holding, renamed Chrome Holding, reached a court-approved settlement with its cyber insurers to buy back $16.5 million in unused cyber insurance coverage. The funds are designated for covered creditor and claimant losses tied to cyber and privacy litigation, including the 2023 breach and Lemonaid Health pixel-tracking claims.
By the time of the bankruptcy settlement, court records showed that nearly $8.5 million of the cyber insurance limits had already been approved for defense costs tied to covered matters. This reduced the unused coverage remaining under the policies.
TTAM Research Institute, founded by 23andMe co-founder Anne Wojcicki, acquired key 23andMe business lines in July 2025. It said it would maintain privacy commitments and applicable legal protections for customer data.
In October 2023, 23andMe suffered a credential stuffing incident that later became the basis for cyberattack litigation. Reporting says the attack affected about 7 million customers worldwide.
23andMe's cyber insurance program for the relevant claims period began with $25 million in aggregate coverage under policies running from May 1, 2023, to May 1, 2024. The policies were eroding, meaning defense costs reduced the remaining limits available for claims.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A coalition of 42 U.S. state attorneys general reached an **$18 million settlement** with 23andMe over cybersecurity failures tied to the company’s 2023 breach, which exposed genetic and other personal information belonging to **6.9 million people**. Authorities said the company failed to defend against credential-based attacks, lacked adequate intrusion prevention, did not properly log and monitor for intrusions, failed to remediate known vulnerabilities, and did not investigate unusual login activity. The settlement also imposes new security and governance requirements on the **23andMe Research Institute**, which acquired the company’s assets, including genetic data, after its 2025 bankruptcy, while preserving customers’ rights to delete personal data and destroy genetic samples. In a related bankruptcy ruling, a U.S. judge held that **California cannot seek monetary damages** from the company formerly known as 23andMe because its Chapter 11 reorganization plan bars those claims, though the state may still pursue non-monetary remedies. The court said California had participated in the bankruptcy case and had an earlier opportunity to challenge jurisdiction, requiring the state to amend or dismiss its lawsuit to remove claims for civil fines. The bankruptcy process also created a customer claims fund, and the court has authorized **$46.75 million** in total payouts connected to the breach.
Aug 11, 2026
California Attorney General Rob Bonta has sued 23andMe over its 2023 breach, alleging the DNA testing company failed to implement reasonable safeguards for highly sensitive customer data and misled consumers about the incident. State investigators said attackers used a credential-stuffing campaign against roughly 14,000 accounts over about five months, ultimately exposing the personal and genetic information of 6.9 million people, including 855,541 California residents. The compromised data reportedly included genetic predispositions, health risk factors, ancestry, ethnicity, and biological-relative information. The complaint alleges 23andMe failed to defend against a well-known attack technique, overlooked warning signs such as spikes in login attempts and public discussion of the breach, and left additional weaknesses in its **DNA Relatives** feature. Bonta also said the stolen data was later advertised for sale on the dark web with references to **Asian American Pacific Islander** and **Jewish** users, heightening concerns about targeted harm. The lawsuit follows a class-action settlement approved in January 2026 for up to **$50 million**, and comes as California separately challenges the sale of consumers’ genetic data and biological samples in 23andMe’s bankruptcy case.
Jun 29, 2026
Labcorp agreed to pay **$35 million** to settle class-action litigation tied to the 2018–2019 cyberattack on its former billing vendor, American Medical Collections Agency, operated by Retrieval-Masters Credit Bureau. Labcorp said the incident affected nearly **10.3 million patients** whose personal information had been sent to AMCA and was present in the vendor’s systems between August 2018 and March 2019. Exposed data included **Social Security numbers**, payment card information, and in some cases medical test names and diagnostic codes. Under the proposed settlement, eligible class members can seek reimbursement of documented losses of up to **$5,000**, an estimated pro-rata cash payment of about **$50**, and **two years of medical and healthcare information monitoring**. Labcorp denied wrongdoing, and a final fairness hearing is scheduled in New Jersey federal court on Aug. 20. The AMCA breach affected roughly **24 million people** across dozens of clients, also hit Quest Diagnostics and BioReference Laboratories, contributed to AMCA’s 2019 bankruptcy, and previously led to a 2021 multistate settlement with **41 state attorneys general**.
Jun 29, 2026