Twitter/X Safety Team Statement on SECGov Account Takeover
twitter.com
twitter.com
Sounds like they got sim-swapped
> We can also confirm that the account did not have two-factor authentication enabled at the time the account was compromised. We encourage all users to enable this extra layer of security.
Funny enough one of the 2fa options is sms which would not have helped here at all!