23andMe has released new details about the credential stuffing attack that took place in October.