I received a notification today from Github indicating my account was compromised and reached out on why it did not display in my security status. They indicate

I received a notification today from Github indicating my account was compromised and reached out on why it did not display in my security status. They indicated that the account was accessed via API and that I should enable two factor. Why raises the question -- how were YOU compromised with 2 factor on?