Thousands of Canadians whose sensitive genetic information was exposed in 23andMe’s massive 2023 data breach may soon be eligible for compensation after a $4.49-million settlement was announced in a Canadian class-action lawsuit.
KND Complex Litigation, a Toronto-based law firm, revealed the proposed settlement on Dec. 3. It covers class-action cases filed in the Supreme Court of British Columbia between October 2023 and September 2024 on behalf of Canadian customers whose personal data was compromised.
The breach, which affected more than 6.9 million 23andMe users worldwide, sparked investigations on both sides of the border. In June, Canada’s privacy commissioner, Philippe Dufresne, concluded that the company failed to adequately safeguard customer data. The settlement now aims to compensate affected Canadians, though 23andMe continues to deny wrongdoing and says the agreement is not an admission of liability.
The settlement is still subject to court approval. A hearing is scheduled for Feb. 17, 2026, in U.S. Bankruptcy Court — a necessary step after 23andMe filed for bankruptcy earlier this year. If approved, a Canadian court will then review the agreement before any funds are distributed.
Once legal fees, taxes and administrative costs are deducted, remaining funds will be paid out according to the Canadian Data Breach Settlement Class Benefits Plan.
To receive compensation, eligible customers must meet all of the following criteria: they were 23andMe customers between May 1 and Oct. 1, 2023; they lived in Canada during that period; and they received official notice from 23andMe confirming their personal information was exposed.
Two types of claims will be available. Extraordinary claims allow reimbursement of up to $2,500 for documented out-of-pocket expenses directly related to the breach. Ordinary claims offer a pro-rated compensation amount and require no documentation.
For now, eligible customers who agree with the settlement do not need to take any action. If final approvals are granted, detailed instructions will follow. Canadians who wish to opt out of the class action must submit an opt-out form by Jan. 2, 2026. The same deadline applies to anyone who wants to object to the settlement terms or legal fees.
The 2023 breach caused lasting fallout for the genomics company. Stolen data — including profiles of users with Ashkenazi Jewish and Chinese ancestry and even high-profile business figures — appeared for sale on BreachForums for as little as $1 to $10 per account. 23andMe later confirmed the breach was carried out through a “credential stuffing” attack, where hackers accessed accounts using passwords recycled from other sites.
In the United States, the company has already agreed to a separate US$30-million settlement covering more than 40 class-action lawsuits. Financial strain from the breach and subsequent litigation ultimately pushed 23andMe to file for bankruptcy.
For Canadian customers, final approval of the settlement would mark the first step toward compensation after one of the most significant personal data breaches in recent memory.