> It reads like the author is basically guessing, in the lessons learned he mentions 2FA and in the same sentence he mentions that it might not have helped ulti

> It reads like the author is basically guessing, in the lessons learned he mentions 2FA and in the same sentence he mentions that it might not have helped ultimately. If the attack was mounted via faked documents which is what I think the article implied then 2FA would not have helped as it was attack on a procedure of replacing contact info.