This is why MFA (not SMS based) is so critical especially for services like this. I sometimes hate it when it is forced on me as a consumer but for these types of services, it absolutely must be enforced. Kinda cop out for 23andME to just blame the users even though users should take some blame of course.

In 2024, if you want to access a highly sensitive database, you must be forced to setup MFA at the minimum. My opinion.