Business practices of not caring about securing the populations genetic information with even basic measures such as enforced two factor authentication and compromising the lives of many innocent non-customers through a basic low-skill attack like credential stuffing.

I would straight up say they need to be regulated as a healthcare provider and be subject to the security provisions of HIPAA. That would be a start.

You share a lot of DNA with your parents, and your children. If one of them used 23AndMe, now a par of your DNA is with them.