Outside of the settlement funds, 23andMe has also agreed to pay for identity monitoring services for three years to all affected users. The so-called “Privacy & Medical Shield + Genetic Monitoring” is a customized program that’ll offer a wide variety of cybersecurity products, including a password manager, anti-phishing protection and medical record monitoring, according to a court document.

The settlement also requires 23andMe to bolster the company's security, including mandating multi-factor authentication and conducting more cybersecurity audits. In a statement, 23andMe noted that it expects to pay $25 million for the settlement through the company’s cyber insurance. “We continue to believe this settlement is in the best interest of 23andMe customers, and we look forward to finalizing the agreement,” the company added.