According to a Securities and Exchange Commission (SEC) filing by 23andMe, the October hack originally accessed a very small percentage (0.1%) of user accounts by using compromised usernames and passwords from other sites that were the same as what the users had for their 23andMe accounts.
As The New York Times reports, some of those hacked had opted in to a 23andMe feature called DNA Relatives, which allows users to share some of their information with other users who could have similar DNA, suggesting an ancestry connection. The hackers used this sharing connection to gain access to millions of more users' data - around 5.5 million more.
[
add
]
[
|
|
...
]