A cyber attack may have compromised the sensitive personal and genetic information of millions of 23andMe users.
Join the Claim isn’t a law firm. We connect you with regulated UK firms that run group action claims. If one of our partner firms takes this case forward, we’ll share more details, including how to check your eligibility.
Join the Claim Limited is a claims management company. This claim is not regulated by the Financial Conduct Authority. Join the Claim Limited is authorised and regulated by the FCA (FRN: 1053404) for regulated claims management activities only.
Register your interest
Overview
In 2023, 23andMe experienced one of the world’s biggest genetic data breaches.
Cybercriminals gained unauthorised access to around 14,000 customer accounts by using email addresses and passwords exposed in previous data breaches. This type of attack, known as credential stuffing, can succeed when people reuse the same login details across multiple websites.
The impact went far beyond those 14,000 accounts. Because 23andMe’s DNA Relatives feature allows users to connect and share information with genetic relatives, the attackers were able to access data linked to around 6.9 million people.
In July 2026, a US bankruptcy court approved a $46.75 million settlement for eligible US customers affected by the breach. That followed a £2.31 million fine issued by the UK’s Information Commissioner’s Office (ICO). However, ICO fines are paid to the government and do not provide compensation to people affected by a data breach.
The US settlement does not include UK users. However, people affected in the UK may still have rights under UK data protection law.
We’re monitoring the situation closely. Register your interest and we’ll keep you updated if one of our regulated partner law firms decides to investigate a claim on behalf of affected UK users.
23andMe – At a glance
Status
23andMe will pay
$46.75 million to settle US claim
UK fine
£2.31 million
People eligible
6.9 million globally
Take a moment to answer a few simple questions so we can understand your connection and keep you updated.
Share your details so we can keep you informed if any updates become available.
If a partner law firm takes this claim forward, we’ll let you know the next steps and how to join.
Hackers gained unauthorised access to around 14,000 23andMe customer accounts using email addresses and passwords exposed in previous data breaches. They then exploited 23andMe’s DNA Relatives feature, which allows users to connect and share information with genetic relatives, to access data linked to around 6.9 million people. The compromised information included names, profile photographs, ethnicity, family trees and, in some cases, health-related reports. Although raw DNA data was not stolen, the breach exposed an extraordinary amount of highly sensitive personal information.
Hackers accessed a wide range of personal information, including names, birth years, profile photographs, self-reported locations, ethnicity and ancestry information, family trees, relationship labels and the percentage of DNA shared with relatives. In some cases, health-related reports were also accessed. Although raw DNA data was not stolen, the breach exposed an extraordinary amount of highly sensitive personal information.
Millions of people are affected by the 23andMe data breach, including many in the UK. 23andMe said it has written to all affected users. Register to stay updated and we’ll let you know if a partner law firm takes this claim forward.
No. Registering simply means you’ll receive updates. If a law firm later takes on the case, you’ll be given the option to learn more about the process and any potential costs before deciding whether to take part.
A group action claim allows people affected by the same issue to take action together. This strength in numbers helps stand up to big organisations. Join the Claim helps connect people with law firms so these actions have a real impact.
No. You are free to contact a solicitor directly at any time if you would like legal advice or wish to explore a claim.
When you register your interest with Join the Claim, we’ll keep you updated if one of our regulated partner law firms decides to take the claim forward. However, other law firms may also investigate or pursue claims independently of Join the Claim.
Registering for updates does not prevent you from speaking to another law firm or joining a claim elsewhere.
We are not a law firm. Our role is to keep people informed about potential group actions if one of our regulated UK partner law firms is able to take this claim forward.
July 2026
A US bankruptcy court approves a $46.75 million settlement for eligible US customers affected by the 2023 data breach. The settlement does not include UK users.
June 2025
The UK's Information Commissioner's Office (ICO) fines 23andMe £2.31 million, finding the company failed to implement appropriate security measures before the breach, including mandatory multi-factor authentication and stronger password protections.
June 2024
The UK’s data protection watchdog launched a joint investigation into the 23andMe data breach with its Canadian counterpart. The investigation will look at whether 23andMe had adequate safeguards to protect the highly sensitive information within its control.
March 2025
23andMe files for Chapter 11 bankruptcy protection in the United States.
December 2023
23andMe confirms the scale of the breach and notifies affected customers.
October 2023
Cybercriminals gain access to around 14,000 23andMe customer accounts using stolen login credentials. By exploiting the company's DNA Relatives feature, they are able to access information linked to around 6.9 million people.
We’ll provide more updates on this case as they happen.
If you used 23andMe, your data may have been exposed.
Register to stay updated and we’ll let you know if a partner law firm takes this claim forward.
We connect consumers with their legal dream teams to ensure they get the compensation and support they deserve.
Join the Claim is not a law firm. We connect individuals with top law firms for group or individual claims, and our service is free to use. While we may receive a fee from the law firms we introduce you to, this will not affect your costs or compensation. We are not responsible for the advice or services provided by these firms. Please note, nothing on this website is legal advice, and while we check claim eligibility, we cannot guarantee a law firm will accept a case.
Join the Claim is a trading name of Join the Claim Limited, authorised and regulated by the Financial Conduct Authority (FRN: 1053404). Registered in England and Wales, Company No: 16245278. Registered office: 32 Eyre Street, Sheffield, S1 4QZ.
© Join the Claim All Rights Reserved |
