> detected unauthorized activity on a small number of user accounts where transactions were being approved without the 2FA authentication control being inputted

> detected unauthorized activity on a small number of user accounts where transactions were being approved without the 2FA authentication control being inputted by the user. How am I supposed to read it: is it a 2FA compromise (attacker replaced 2FA codes with their own) or 2FA bypass (attacker found a way to conduct a transaction bypassing a need for 2FA)? These are two very different scenarios.