> But what kind of feature would allow attackers to then get access to 7 million accounts from 14,000 compromised accounts? I've never used 23andme myself, but

> But what kind of feature would allow attackers to then get access to 7 million accounts from 14,000 compromised accounts? I've never used 23andme myself, but as I understand it they have a 'relative finder' which finds people with similar DNA https://customercare.23andme.com/hc/en-us/articles/221689668-DNA-Relatives-In-Common-Report-Feature- https://customercare.23andme.com/hc/en-us/articles/221689668... - it even offers some features that purport to show which segments of your genes overlap. They also provide a predicted-and-editable-and-shareable family tree feature https://customercare.23andme.com/hc/en-us/articles/360036068393-The-23andMe-Family-Tree-Feature https://customercare.23andme.com/hc/en-us/articles/360036068... At one point, I believe users were opted into this by default (a review from 2008 says this was the case) although at present I believe they require an explicit opt-in. But of course you can't find your relatives without opting in. And users might well have thought they were sharing their data only with a handful of relatives, whose identities had been confirmed by DNA testing.