I have zero insight into how the 2FA phone number was stored or how it could have been accessed. I can't admit to anything I don't know about :) I agree that

I have zero insight into how the 2FA phone number was stored or how it could have been accessed. I can't admit to anything I don't know about :) I agree that in a well designed system and process 2FA numbers should not be accessible (like passwords). However, I've seen this as a common practice in quite a few startups.