Hacker News Reader

If he was using SMS for 2FA, he still would have been compromised.

The article states that if 2FA is enabled, then answering a security question or access to the recovery email is also required.