The company did not leak it. People reuse passwords. "Hackers" just tried passwords from earlier dumps and accessed profiles of people who reused the same password with 23&Me

As soon as a cousin or two does it the cat’s kind of out of the bag, isn’t it?

Isn’t that what all of these “I did my DNA and you’re my dad!” and “Ancestry.com cold crime DNA break” stories prove?

Or if a neo-Nazi firebombs your house, your cousin's house, your parents' house, and some guy who you didn't know was your uncle since he was given up for adoption, but was also Jewish. How do you correlate that to a data breach?

That's why this data breach is so dangerous. It helps fill in nearly every stepping stone for bad actors, all the way to the baddest of them, to cause harm or exploit someone.