Those are my questions, too. It boggles my mind that so many accounts didn’t seem to raise a red flag. Did 23&Me have any sort of suspicious behavior detection?

And how did those breached accounts access that much data without it being observed as an obvious pattern?