Maybe you shouldn’t use the same user+pass across dozens of different services then.

The data from 23 and Me was stolen using the legitimate login credentials of users acquired from an entirely different services data breach. Not via their own lax security policies.

You can’t expect a corporation to protect you from yourself. And they certainly shouldn’t be punished for your ineptitude.

Don’t get me wrong, these corporations are not your friends, and shouldn’t be trusted implicitly; but you have some responsibilities too.

/edit:

But when the chips are down and our data is leaked, they hide behind the old “we were not hacked; it was the users’ old passwords” excuse.

This logic is equivalent to a bank saying, “It’s not our fault your money got stolen; you should have had a better lock on your front door.” It’s unacceptable and a gross abdication of responsibility.

I completely disagree with this point. The service obviously has to provide you with access to your information/account. If you give out your login credentials for that access to a third party (another service), that third party loses your information, and it’s then used to access stuff posing as you. That’s your fault. You should not have shared (re-used) those same login credentials with others.