4 ms·

Encryption at rest.

• tzs 3y ago
  What makes you think they didn’t have that? The bad guys obtained user passwords from breaches at other sites where some 23andMe users had accounts and had used the same email and password as their 23andMe account. They logged into those 23andMe accounts and obtained data that those accounts had access to.
  • buffington 3y ago
    Credential stuffing attacks are detectable and preventable, which is what you're describing. When detected (trivial with the right tools), you can then require users to reset their passwords for the suspected accounts (with the traditional "check your email for reset link" dance).