I wonder if this was a curious attacker trying to see what they could do with their access, or a targeted attack.
You can btw use the password reset function on many sites to correlate it with notifications. Easy at public events.
"Holy shit are those Signal 2FA codes? That's wild"
In my head, this is something a more teenager (e.g. Lapsus) might think?
Yes. I mean why not, you've got the number(s).
They also apparently have logs of the attacker searching out three specific accounts within these 1900. That seems odd. What’s the chance that, out of all signal accounts, the three they are curious about just happen to be among the 1900 they got access to? (Perhaps signal/trillio don’t have logs from failed searches? That would be pretty poor logging though)
Any Signal accounts that did not start that process during that time would not be able to be intercepted or accessed since Twilio has no means to begin it. The three specific accounts mentioned would be the cases found that the verification message was accessed through Twilio to register the account on the attacker's device.
So yes, in effect the 1900 were only the ones around when the attacker got access. Whether the specific three were targeted attacks or random messing around isn't clear though.