Hacker News Reader

They changed the email addresses first to an account they controlled.

As I understand it, the internal tools allow for changing the email. Change email -> password reset.

If this is true then it completely defeats the purpose of a two-factor authentication

Almost all internet companies have internal tools to disable 2FA. People destroy/break/etc their phones constantly and need it reset.

2FA is meant to protect against someone impersonating you. It is not designed to protect against malicious insider at the org you are trying to prove your identity to

But operations like that should require a second randomly chosen individual to verify.

The reality is the public loses credentials and keys all the time and at most companies security takes a back seat to convenience and customer service.

I'd assume they had the ability to change the email on the account.