In 2023, attackers didn’t need stealthy tactics to wreak havoc on 23andMe, they just logged in. Using passwords stolen from other breached sites, they spent five months going after 23andMe’s login page. Nothing flagged the traffic as suspicious. By the time anyone noticed, 14,000 accounts were gone¹.