I do not reuse passwords, and from what I understand, my account was not accessed directly. The message they sent me was:
"After further review, we have identified your DNA Relatives profile as one that was impacted in this incident. Specifically, there was unauthorized access to one or more 23andMe accounts that were connected to you through DNA Relatives. As a result, the DNA Relatives profile information you provided in this feature was exposed to the threat actor."
So there's nothing I could have done with password security that would have prevented this; my only mistake was using a feature of their site.
"After further review, we have identified your DNA Relatives profile as one that was impacted in this incident. Specifically, there was unauthorized access to one or more 23andMe accounts that were connected to you through DNA Relatives. As a result, the DNA Relatives profile information you provided in this feature was exposed to the threat actor."
So there's nothing I could have done with password security that would have prevented this; my only mistake was using a feature of their site.