The document says that the accounts may have been accessed using id/password combinations obtained from other sources. But doesn't TurboTax have two-factor authentication? If so, how is this possible? If not, what would an extremely important service like TurboTax not have two factor authentication?