[bananabreakfast]

It says right there in the linked page that the phishing attack was able to manipulate multiple employees into giving access past their 2FA.

[Thorrez]

Yeah, that answers 1 of the questions. But we still don't know what type of 2FA was being used, or what technique the attackers used.