Judge approves $46.75m payout to affected users
A US bankruptcy court has ordered Chrome Holding, which took control of the consumer genetics company following its insolvency, to pay $46.75m in compensation to victims of a 2023 data hack. The ruling instructs that the settlement be first paid to a court-appointed restructuring firm, Kroll Restructuring, within five business days, after which the firm will distribute the funds to eligible claimants.
The scale and nature of the breach
The company suffered a breach in 2023 in which hackers accessed roughly 14,000 user accounts directly, but were able to reach the genetic profiles of many more people through familial links. That secondary exposure meant millions of profiles hosted by the service could be viewed by the attackers, with some estimates indicating up to 6.9 million profiles were affected. The data included detailed genetic markers, family-relationship information and other sensitive details that users submit when they use ancestry and health services.
Legal and regulatory consequences
The breach prompted inquiries by data protection authorities and law enforcement, and led to fines and further legal action. A UK data regulator imposed a fine of £2.31m for failures to secure sensitive user data. Separately, the attorney general of California initiated a lawsuit in May, alleging the company failed to take basic steps to protect users’ information and misstated the severity of the breach to consumers.
Corporate restructuring and asset sale
The company filed for bankruptcy early last year, and its assets were later sold through a bankruptcy auction. Chrome Holding, which had taken control during the restructuring process, sold the assets to an entity called TTAM Research Institute. That entity is operated by the company co-founder, who won the auction with a bid reported to be $305m. The firm continues to operate a consumer genetics service and offer test kits for sale.
How victims will receive compensation
The court order specifies that settlement funds be delivered to Kroll Restructuring, an independent firm commonly appointed to manage distributions in bankruptcy cases, within five business days. Kroll will then be responsible for identifying eligible claimants and distributing payments. The court did not immediately set out the number of claimants who will share in the settlement, nor the size of individual awards, which typically depend on claim documentation and approved damage calculations.
Wider implications for consumer genomics
The case highlights the risks associated with storing highly personal genetic data on commercial platforms. Consumer genetics services combine ancestry information with health-related markers and family-linking features that, when exposed, can reveal intimate details about individuals and their relatives. The settlement and prior fines underline growing regulatory and legal scrutiny for firms in this sector, and may increase pressure on companies to strengthen technical and organisational safeguards.
Company history and financial context
The business began in the mid-2000s and once achieved a valuation in the billions of dollars, reaching public markets in 2021. Despite rapid growth and high valuations, it never reported sustained profitability and entered formal insolvency proceedings approximately 18 months after the breach. The bankruptcy process and subsequent asset sale were intended to preserve operations while resolving creditor and claimant claims.
What affected users should do now
People who believe they were affected should monitor communications from the restructuring firm or any appointed claims administrator for information about eligibility and how to file claims. Victims should also review their personal accounts for unusual activity and consider available identity protection measures. Regulators have advised consumers to stay alert to phishing attempts that can follow high-profile data incidents.
The court ruling provides a concrete financial remedy for victims, but questions remain about the long-term obligations of firms that hold sensitive genetic data. As consumer interest in genealogy and health-related genetics grows, the sector faces a pivotal period for trust, security and regulatory oversight.
