23andMe reaches Canadian settlement in data breach class action lawsuit

Genetics data company 23andMe has reached a settlement with plaintiffs in a Canadian class action lawsuit over a 2023 data breach, the law firm behind the suit says.

In October 2023, 23andMe identified and disclosed a massive data breach affecting seven million customers worldwide, among them nearly 320,000 Canadians.

In October 2023 and September 2024, class actions were filed in the British Columbia Supreme Court on behalf of 23andMe’s Canadian customers, and later certified by the court.

“The Plaintiffs and 23andMe have reached a settlement as part of 23andMe’s insolvency proceedings,” the law firm KND Complex Litigation said in a statement Wednesday.

The settlement still needs to be approved by the courts.

1:57 23andMe fined $4M+ for genetic data breach

The company filed for bankruptcy in the United States in March after struggling with the fallout of a data breach and weak demand for its ancestry testing kits.

Story continues below advertisement

The proposed Canadian settlement covers anyone who was a 23andMe customer between May 1 and Oct. 1, 2023, lived in Canada during that window and received a notice from 23andMe notifying them that their personal information was compromised in the data breach.

Get breaking National news

For news impacting Canada and around the world, sign up for breaking news alerts delivered directly to you when they happen. Sign up for breaking National newsletter Sign Up By providing your email address, you have read and agree to Global News' Terms and Conditions and Privacy Policy.

“The settlement remains subject to approval by the courts in the United States and Canada,” said Sage Nematollahi, the lead Canadian lawyer on the class action lawsuit.

The total proposed settlement involves a payout of $4.49 million (US$3.25 million).

The settlement website said customers may be eligible for a reimbursement of up to $2,500 “for specific documented, unreimbursed, out-of-pocket expenses incurred a direct result of, and in response to, the Cyber Security Incident.”

However, the cheques aren’t coming in just yet. The next steps for anyone expecting compensation is to “do nothing,” the website adds.

1:19 23andMe lacked strong data protection allowing for breach: Canada’s privacy head

The United States Bankruptcy Court will hear an application for final approval of the proposed Canadian settlement on Feb. 17, 2026, to be followed by an application for final approval by Canadian courts.

Trending Now

• Canada’s federal income tax brackets are changing in 2026
• A ring with an extra carrot ends decades-long mystery for Alberta couple

Story continues below advertisement

“Assuming that the court in the United States approves the settlement, it will have to come back and get in front of the Supreme Court of British Columbia for approval of the settlement on the Canadian side as well,” Nematollahi said.

Approval by courts will be followed by a claims process, Nematollahi said, adding that potential claimants can check the settlement website for updates and information.

Anyone who objects to the settlement — for example, individuals who plan to pursue private litigation — can fill out an opt-out form and send it before Jan. 2, 2026.

In June, Canadian Privacy Commissioner Philippe Dufresne and U.K. Information Commissioner John Edwards released the results of their joint investigation, which found 23andMe had “inadequate” security systems and was “slow to respond” to warning signs that customers’ sensitive data was at risk before the “profoundly damaging” 2023 data breach.

The investigation found that of the almost seven million people impacted worldwide, nearly 320,000 Canadians and more than 150,000 people in the U.K. had their sensitive genetic information compromised by hackers.

1:54 U.K. fines 23andMe over ‘profoundly damaging’ data breach

Dufresne said the breach serves as a “cautionary tale” for all organizations about the importance of data protection.

Story continues below advertisement

The U.K. information commissioner levied a 2.31 million-pound fine against 23andMe.

–with files from Global’s Sean Previl

 

More on Lifestyle More videos

• Air Transat pilots vote overwhelmingly for strike mandate
• A ring with an extra carrot ends decades-long mystery for Alberta couple
• Wegovy won’t be in Canadian public drug plans as Novo Nordisk refuses talks
• As Canada Post talks continue, business uncertainty grows as holidays near

• Conservative MLA calls on NDP government to give Kelowna break on short-term rental rules
• Penticton votes against tiny homes project
• B.C. food bank use at record level
• What captured the zeitgeist in 2025? YouTube top trends shed a light on most memorable themes, memes and moments