George Frey/REUTERS
- July 14, 11:59 p.m. Central Time is your last chance to file a claim in the 23andMe bankruptcy case.A 2023 cyberattack on 23andMe exposed the genetic data of nearly 7 million users.Twenty-seven states and DC have sued 23andMe to stop it from selling customers' genetic data.
Today, July 14, is your last chance to file a claim in the 23andMe bankruptcy case.
The genetic testing firm, which filed for Chapter 11 bankruptcy in March, is offering eligible customers the chance to seek damages tied to a 2023 data breach that exposed the sensitive personal information of nearly 7 million users.
The breach includes names, ancestry results, relationship data, and shared DNA percentages.
Customers have until 11:59 p.m. CT Monday, July 14, to file claims electronically, or until 4:59 p.m. CT if submitting by mail. The deadline was originally set in May by the US Bankruptcy Court for the Eastern District of Missouri.
How to file a claim and check eligibility
Customers can file two categories of claims: one for damages related specifically to the cybersecurity incident and another for unrelated issues tied to 23andMe's services.
Cybersecurity Incident Claims are available to individuals who used 23andMe services between May 1 and October 1, 2023, received notification that their data was compromised in the breach, or suffered any form of harm as a result.
For those with claims against 23andMe that are not cybersecurity-related, such as disputes over DNA results or telehealth features, there is also a General Bar Date Package available for filing. The same deadline also applies.
What happened to 23andMe?
23andMe initiated voluntary Chapter 11 bankruptcy and put the company up for sale. The company had weathered a series of challenges in recent years, including the data breach.
In May, Regeneron Pharmaceuticals said it would acquire 23andMe for $256 million. The company develops therapeutics based on antibodies.
Following the potential sale, 27 and the District of Columbia sued the DNA testing company on Monday to prevent it from selling customers' genetic data without requiring "explicit consent."
In the complaint, filed on Monday in the US Bankruptcy Court in the Eastern District of Missouri, the states said they want to enforce consumer protection and data privacy laws on behalf of their residents.
"Virtually all of this personal information is immutable. If stolen or misused, it cannot be changed or replaced. Furthermore, this data is exclusively personal and unique, representing that customer's identity and no other human being," the complaint says. "In addition, this exclusively personal data carries with it significant, sensitive information about others who share DNA and/or familial relationships."
News of a potential sale concerned some consumers and lawmakers who questioned how 23andMe could ensure that any new owner protects the sensitive data. Although 23andMe said in March that any interested parties needed to adhere to their consumer privacy policy and applicable laws to be considered, there's little preventing new owners from changing those policies after a sale, and some customers remain uneasy.
"The customer's genome could remain in existence in corporate hands and subject to use (ranging from research to cloning) long after future generations of 23andMe's consumers have passed away," the complaint says.
A 23andMe spokesperson told Business Insider that the arguments in the complaint are "without merit, and we will address them at the sales hearing." Representatives for Regeneron Pharmaceuticals did not respond to a request for comment from Business Insider.
Customers can still delete their data from 23andMe if they're worried. Here's how.
How to ask 23andMe to delete your data
Users who want their personal information removed from 23andMe can opt out in the "23andMe Data" section in Account Settings. But 23andMe says it is legally required to retain some information.
"While we will delete the majority of your Personal Information, we are required to retain some information to comply with our legal obligation," the company's website says.
"23andMe and/or our contracted genotyping laboratory will retain your Genetic Information, date of birth, and sex as required for compliance with applicable legal obligations... even if you chose to delete your account," the company's privacy statement says.
The privacy statement says 23andMe will also retain some information associated with user accounts, like email addresses.
For users who participated in 23andMe Research, their genetic data and self-reported information won't be used in future research projects.
"Customers always have the option to delete their account at any time, and once the request is confirmed, we will immediately and automatically begin the deletion process," the spokesperson said. "Deleting an account and associated data will permanently delete the data associated with all profiles within the account. If a customer asks us to store their genetic samples, they will be discarded."
