They stuffed passwords to get them access to information not just on the compromised accounts' profiles but to detailed data on a large group of other people whose accounts weren't compromised through a function within 23andMe's database browser.