> The attacker used social engineering to gain access to a mobile phone number that allowed them to gain access to other accounts, one of which had access to an old database backup from the forum.

Forgive me if I'm missing something blatantly obvious, but how was a hacker able to gain backup access with just a phone number? What kind of auth is that?