> unfortunately did provide the attacker one additional multi-factor authentication (MFA) code How is this Google's fault? Which rock was this employee living

> unfortunately did provide the attacker one additional multi-factor authentication (MFA) code How is this Google's fault? Which rock was this employee living under to not have understood you NEVER give an OTP code to anyone?