IIRC Uber was hacked via human weakness in multi-factor authentication. It’s actually something a ton of companies are vulnerable to so I wouldn’t be at all surprised to see it replicated here.
Are there any network security that uses AI to automatically detect and flag unusual behavior? For example, a regular developer doesn't need to port scan the entire network, the receptionist's computer doesn't need to log in to admin resources, support personnel doesn't need to access source code, etc. This should be possible to flag and let a human verify.