The account didn't have any kind of 2fa - even SMS would have stopped this breach. Obviously hardware keys are the gold standard but I wouldn't trivialize the amount of work it takes to roll that out to an organization.
I would, it's pretty trivial (I have done it for multiple organizations of different sizes/technical competencies). Especially for something like a VPN; at this point if you use a VPN solution which doesn't support MFA it almost certainly has other security issues as well.
I have a family member who had a very junior role at a big finance company 15 years ago and they used hardware keys. Seems like national infrastructure should require similar levels of security.
For any sysadmins or future sysadmins reading this though, do NOT put your service's 2FA on SMS. Do not use SMS for anything other than sending your grandparents a happy birthday message. It is trivially broken with a sim card hijack and we have seen many high profile incidents of people being hacked precisely through this vector.
...and yet, it would have been better than this setup.
These days cheapskate companies will insist on a validator app on employee provided phone rather than take the hit on capital expenditure for a proper key. It would be nice to have legislation that bans that practice.
I think legislators will start setting how important it is to protect infrastructure and implement something similar to PCI/DSS.
For most things regular any kind of MFA is good enough. Even just a password can be acceptable if it's not too important.
For stuff that ends up in international newspapers you definitely want more than that though.