What I see happening in real life is.. Hacker has access to Foo that's how they got your creds. If they want more access they will use the admin account to ga

What I see happening in real life is.. Hacker has access to Foo that's how they got your creds. If they want more access they will use the admin account to gather all info Foo knows. Hacker picks a global service. Paypal, gmail, appleid, godaddy and tries all usernames/passwords. When they hit 2fa they attempt a code. 99% of times it fails. You get a warning/change the password and get scared. User receives an email saying that you have beenhacked. They have proof you did something illegal or something illegal has been planted. Send bitcoin here or this video will be sent to all of your friends/work/family. ---- 2fa usually locks you when you need it the most (no battery/texts not going through/paid bill latertexting is turned off can cause this)