From what I’m seeing, the hackers used the weak password accounts to access a larger vulnerability once they were behind the curtain. The company I work for deals with sensitive proprietary data daily and we are keenly aware that individuals should never have an opportunity to access the information if any other user. Things like single-user quarantining of data blocks are a minimum for security. Users log in and live on their own private island floating in a void. On top of that use behavior tracking to detect access patterns that attempt to exit the void and revoke credentials. That is also not even remotely mentioning that you have a single point of access entering thousands of accounts. That on it’s own should be throwing enough red flags to pull down the webserver for a few minutes to hours. There is a lot they could have done.

Yes, one of those “confirm it’s you” emails. They’re less intrusive than regular 2FA, and are only needed when a user logs in from a machine without the right cookie

Hello, as I said, it’s about “security by design”, which means to design a system that ‘doesn’t allow for insecure things’ in the first place. Like a microwave oven doesn’t operate when the door is open. IT-/cyber-security is a complex field, but 2FA is a good place to start, regarding user facing services. There are lots more things than that of course.