My thought is maybe they didn’t really do 2FA, but exploited a password reset mechanism that only required 2FA? IE: single factor resets, so a compromised “2FA

My thought is maybe they didn’t really do 2FA, but exploited a password reset mechanism that only required 2FA? IE: single factor resets, so a compromised “2FA” was actually keys to the kingdom? But you’d think the attacker would need access to a user’s email or some such then.