The attack vector in this case appears to have been read access to the user's SMS messages. (Via some kind of a tee rather than a traditional SIM swap, since th

The attack vector in this case appears to have been read access to the user's SMS messages. (Via some kind of a tee rather than a traditional SIM swap, since the user was also getting copies on their phone. My best guess would be that their mobile operator runs one of those crappy services for reading your SMS via a web browser.) There is no sign that the attacker had a keylogger on the user's laptops, for extracting passwords. If they did, they wouldn't have needed to do account recovery on all these accounts. So the master password of a traditional password manager would not have been compromised.