A spearphishing email telling them they had to update their 2FA was the vector.