23andMe says user data stolen in credential stuffing attack
Unless I'm reading this wrong all that happened was someone had an existing leaked database of emails/passwords and then tried them on 23andme, and if they worked they took the data they could get. Yes, 23andme has some pretty extensive and personal data, but this attack could be done on literally any website. The issue is people re-used passwords, and also did not have 2fa enabled.So the database that is for sale is just a list of emails/passwords from other breaches that worked on 23andme, along with the data that 23andme had on those users.  Not exactly a 23andme breach.