From what I read, people got their credentials breached on some other websites. Hackers then somehow used those same credentials to log in to 23andMe.

I see that 23andMe could’ve forced MFA, or have a better brute force protection for sure but seems like 23andMe themselves didn’t breach any passwords at least.