“We believe that the threat actor may have then, in violation of our terms of service, accessed 23andme.com accounts without authorization and obtained information from those accounts.”

Good to know that these cybercriminals not only skirted the law but also the TERMS OF SERVICE. Must be hardened types to go and break ToS.