23andMe has agreed to pay $30 million to settle lawsuits over a data breach that ensnared 6.4 million users last year.
The breach resulted in the attacker pulling this off by first breaching 14,000 accounts and then exploiting the service’s optional “DNA relatives” feature to access the profiles of millions of other users.
The hacker tried to sell the stolen DNA-related information in a forum at $100,000 per 100,000 user profiles. The incident prompted some victims to hire lawyers and file class action lawsuits, alleging that 23andMe had failed to protect their data.
All affected wont get the settlement, However the settlement, needs final court approval, proposes offering up to $10,000 from the fund for users who file an “extraordinary claim,” meaning they can demonstrate the breach caused them to suffer financial fraud.
Other users are only entitled to a $100 payment. Apart from this settlement funds, 23andMe has also agreed to pay for identity monitoring services for three years to all affected users with a variety of products, including a password manager, anti-phishing protection, and medical record monitoring.
The data breach involved nearly 135,000 patients, and employees of Lehigh Valley Health Network based in Pennsylvania have agreed to a record payout of $65m
The plaintiffs, represented by class-action attorneys at Saltz Mongeluzzi Bendesky, sued LVHN after the company suffered a data breach that exposed 600 patients’ and employees’ medical records and PII that included addresses, email addresses, dates of birth, Social Security numbers and passport information, various medical data as well as nude photos.
It is believed to be the largest of its kind, on a per-patient basis, in a healthcare data breach-ransomware case. Each settlement class member will receive payments ranging from $50 to $70,000 those receiving the maximum had their hacked nude photos published online.
The Lackawanna County Court of Common Pleas, which oversaw the case, has scheduled a final fairness hearing on November 15 to determine if the settlement should receive final approval.
