The hackers broke into this first set of victims by brute-forcing accounts with passwords that were known to be associated with the targeted customers, a technique known as credential stuffing. From these 14,000 initial victims, however, the hackers were able to then access the personal data of the other 6.9 million million victims because they had opted-in to 23andMe’s DNA Relatives feature. 

From the description it sounds like they have a point. If people reuse their passwords and then get hacked, the hackers are going to have access to their full accounts, including any information shared with them.

How is this different than if hackers reused passwords and hacked into Facebook accounts and then saw the user’s friends’ profiles?