23andMe Data Breach Victims to Receive Rp720 Billion in Compensation

Victims of the 2023 data breach at genetic testing company 23andMe are confirmed to receive millions of dollars in compensation from the firm. A California bankruptcy court judge ruled on Tuesday that Chrome Holding must pay US$46.75 million (approximately Rp720 billion) in damages. Chrome Holding took control of 23andMe’s assets last year after the company declared bankruptcy. 23andMe compiles genetic profiles of individuals through DNA testing kits. The company faced sharp criticism after hackers successfully breached the data of nearly 6.9 million people in the 2023 cyber incident. Chrome Holding operates under the name TTAM Research Institute and is run by 23andMe co-founder Anne Wojcicki, who won the company’s assets in a bankruptcy auction last year with a bid of US$305 million. Under the court ruling, the settlement funds will first be paid to Kroll Restructuring, which represents the victims, within five working days of Tuesday. Kroll will then distribute the funds to the affected victims. The legal case began when 23andMe filed for bankruptcy early last year, approximately 18 months after hackers managed to access around 14,000 user accounts. Because the company offers comprehensive genetic profiles, including health and family history markers, some of the information accessed by the hackers was highly personal. Although the number of directly accessed accounts represented only a small fraction of total users, the hackers exploited a relative-finding feature to access the profiles of those accounts’ family members. This ultimately exposed millions of profiles stored by 23andMe. The data breach triggered various investigations and fines, including a £2.31 million penalty from the UK’s Information Commissioner’s Office (ICO). The ICO stated that 23andMe failed to implement adequate measures to secure users’ sensitive data before the incident occurred. California Attorney General Rob Bonta also sued the company after an investigation found that 23andMe ‘failed to take basic steps to protect user data.’ Bonta even claimed that 23andMe ‘lied to consumers about the severity of the 2023 data breach.’ Despite experiencing bankruptcy, 23andMe continues to operate and offer DNA testing kits to the public online. The company, founded in 2006 and listed on the stock exchange in 2021, was once valued at US$6 billion, although it has reportedly never turned a profit.