2fa may not have helped, note that.  add a comment about the strength of passwords on the hacked accounts