> if someone steals credentials from a subset of users and can use that to gain access to nearly half your customer base The article implies that (probably for

> if someone steals credentials from a subset of users and can use that to gain access to nearly half your customer base The article implies that (probably for sensation), but I don't think this is what it means. I assume they got enough matches between these 14k customers to view some level of information on their relatives such as their name. Genetics being what they are (pretty stable between generations), that resulted in a ton of data being shown cumulatively But that's just my reading, per my understanding of 23&M's business model. Maybe they did find a vulnerability that allowed actual account access, but that would be bigger news by itself and the article would be exceedingly likely to mention that explicitly Edit: this other top-level comment seems to confirm that https://news.ycombinator.com/item?id=39116561 https://news.ycombinator.com/item?id=39116561