They seem to be using Google Apps for the e-mail. And they claim:

    > The attacker was able to bypass 2FA due to a flaw on the server host side

Which flaw is this? Is it a known issue for Google? I would like to know more details.