One thing I'd very much like to see here is transparency. The author of this article seems to assume the worst. I don't know if that's a reasonable assumption,

One thing I'd very much like to see here is transparency. The author of this article seems to assume the worst. I don't know if that's a reasonable assumption, but "assumptions" is all we can go on right now. 23andme claims "re-used passwords". We just have to take them at their word for this. I don't think they're outright lying, but you can misrepresent things without strictly telling falsehoods. But if we take them at their word, there's a huge amount of nuance there too – are we talking about a large and advanced botnet or just ten IPs that accessed those millions of accounts? The first might be very hard to protect against, the second would raise a lot more eyebrows. What kind of security measures do they have? Things like that. Right now, all I can really do is ... shrug. Because I just don't have enough information to judge one way or the other. And it would improve security, because forced airing of your dirty laundry is a good motivation for going to the laundrette. In the end this would benefit everyone, including the companies themselves.