Looks like a sidestep around it using an SMS bridge that got hit with an AT&T internal breach.
Twitter has option of using 2FA with a authenticator app though if this is an ATT issue he must’ve fallen victim to a port attack and must’ve been using SMS based 2FA (which many would argue is not really 2FA at all)
Couldn’t he have just gotten phished?
Some forms of 2FA are unphishable. If he used Authy or SMS, where you type in a code that can be intercepted in replayed within a window, yes. If he had set up a hardware key like U2F (like a yubikey), no.
edit because I can't reply: for twitter you have to remove your phone number. I keep TOTP active as a backup, but might not if I had a highly followed account.
Does twitter let you disable sms/authy fallback if you are using u2f? Many websites don't.
One point of 2FA is to protect from phishing.
I was thinking exactly the same. Surely, surely he had 2fa on