What is more unbelievable is that the were able to create a new admin account on 17th December, which is the account that was used (from the tech report): > On

What is more unbelievable is that the were able to create a new admin account on 17th December, which is the account that was used (from the tech report): > On December 19, 2017 an authorized administrative user's credentials were used by an unauthorized user to log into our Cloud Computing Provider. This unauthorized user created a new administrative user account They had 6 and a half months to spot this new admin account, and didn't. This is terrible security practice anyway you look at it, and in that context, their statement that "the attacker used an account without MFA" is disingenuous at best.