23andMe: 'Negligent' Users at Fault for Breach of 6.9M Records

23andMe faced lawsuits after attackers used credential stuffing to access about 14,000 accounts and obtain DNA Relatives information for nearly seven million users; the company argues the exposures resulted from users reusing passwords rather than an internal breach, describes remediations (session termination, forced password resets, law enforcement notification), and the report frames the incident as raising legal and industry questions about shared responsibility for account security and the need for stronger provider-side controls like MFA and adaptive authentication.