23andMe to Get $16.5M in Unused Cyber Insurance

As part of its ongoing Chapter 11 bankruptcy proceedings, 23andMe Holding Co. – now named Chrome Holding – has reached a settlement with its cyber insurers for the carriers to buy back $16.5 million of the consumer genetics testing firm’s unused cyber policy.

See Also: OnDemand | Transform API Security with Unmatched Discovery and Defense

Chrome will use the funds to pay creditors whose claims are covered by the company’s insurance cyber policies, including claims related to cyberattack litigation.

Under the deal, Chrome will indemnify the cyber insurers for claims related to their policies, capped at the $16.5 million settlement payment amount. Also, Chrome will release the cyber insurers from all further claims related to the policies.

23andMe filed for Chapter 11 in a Missouri federal bankruptcy court in March. The court on Thursday approved the buy-back settlement between the company and several of its cyber insurers, including “various underwriters” at Lloyds.

In July, TTAM Research Institute, a California-based nonprofit founded and led by Anne Wojcicki – the co-founder and former CEO of 23andMe – completed its $305 million purchase of the Personal Genome Service and Research Services business lines of 23andMe Holding Co. under U.S. bankruptcy laws (see: Court Approves 23andMe Sale to TTAM Research Institute).

Under TTAM ownership, 23andMe is continuing to operate and provide customers with personalized DNA health and ancestry testing and research services.

Under its winning bid for 23andMe, TTAM committed to comply with 23andMe’s privacy policies and applicable law, including processing all customer personal data according to their consents and allowing consumers to opt out of having their data used for research (see: 23andMe’s Co-Founder to Buy Company, Makes Privacy Pledge).

Cyber Insurance Details

Settlement documents said Chrome had cyber policies for coverage from May 1, 2023, to May 1, 2024, with an aggregate limit of liability of $25 million. Coverage includes cyber extortion losses and expenses for claims related to network security and privacy events.

“The policies are ‘wasting’ or ‘eroding’ policies; thus, the total coverage available under the policies is reduced on a dollar-for-dollar basis on account of, among other things, defense costs – including attorneys’ fees – incurred in connection with lawsuits or claims arising from or related to events covered by the policies,” the court document said.

To date, the various underwriter have approved payments of nearly $8.5 million related to defense costs incurred by Chrome in connection with litigation related to a cyber incident and alleged data privacy incidents experienced by 23andMe, the documents said.

Among them are a consolidated multidistrict class action litigation and arbitration in the U.S – and separate litigation in Canada – related to an October 2023 credential stuffing hack that affected about 7 million 23andMe consumers worldwide.

The bankruptcy court in October preliminarily approved a $30 million settlement in the U.S. class action litigation and a settlement of about $4.49 million (Canadian dollars) in the Canadian litigation involving the credential stuffing incident.

Chrome in October also reached a $3.25 million settlement in proposed class action litigation filed in 2023 alleging that the company’s telehealth arm Lemonaid Health Inc. violated plaintiff and class members’ privacy – among other claims – in the use of pixel tracking codes on its websites that sent consumers’ information to third parties, including Meta.

The agreement between Chrome and its cyber insurers states that the $16.5 million settlement payment to the company “is to be used solely to fund claims that would otherwise be deemed covered claims under the policies.”

That includes, but is not limited to, “settlement amounts contemplated in the class settlement agreements, the U.S. Data Breach Arbitration Settlement Agreement, as well as any other claims filed in the chapter 11 cases relating to or arising from the cybersecurity incident or the Pixel action.”

That also includes class members in the U.S. and Canadian credential hacking litigation settlement – as well as class members in the Pixel tracking lawsuit settlement, who chose to opt-out of the settlements to potentially continue their own litigation against the company.

23andMe did not immediately respond to Information Security Media Group’s request for comment.

‘Long-Tail’ Insurance Risk

Some experts said insurers sometimes buy back policies from their clients – including coverage involving cyber policies – but that is typically in certain complex risk situations that can linger for years with ongoing and unknown defense obligations.

“Buy backs are most common in claims involving old policies and long tail risks – like environmental or asbestos claims – as they permit the insured to take a lump sum of money immediately, the insurer to gain certainty as to their present and future out-of-pocket costs, and both sides to avoid potentially lengthy and expensive coverage litigation,” said insurance attorney Peter Halprin, a partner at law firm Haynes Boone who is not involved in the class action litigation.

“The disclosure regarding the role and availability of cyber insurance to address 23andMe’s cyber and privacy liability highlights the import and value of cyber insurance in providing bottom-line protection for those exposures,” Halprin said.