I wonder if they got the seeds ('secret key' in [1]) for the 2FA as well.

[1] https://en.wikipedia.org/wiki/HMAC-based_One-time_Password_A...