The same thing happened to my previous employer a few months ago. Our SRE had used a very long novel password and access was very limited, but 2FA wasn't enabl

The same thing happened to my previous employer a few months ago. Our SRE had used a very long novel password and access was very limited, but 2FA wasn't enabled because it lacked some features (I'm guessing it was the SMTP, as other poster mentioned). We were able to catch it pretty fast and never asked for refunds or anything, but Sendgrid's support was very standoffish and combative when we asked for help with our "investigation" of how the account was compromised, to the point the company started seeking a competitor.