2FA doesn't guarantee this incident would not have taken place. If it's not hardware-based (i.e. Yubikey), you can still spearphish people into putting their u

2FA doesn't guarantee this incident would not have taken place. If it's not hardware-based (i.e. Yubikey), you can still spearphish people into putting their username, password, and 2FA token into a honeypot page which would give the attacker a window of unauthorized access.