I’m struggling to understand the chain of events, because the story starts midway. Is the claim that JUST the 2FA code was enough to pwn everything with no other vulnerabilities? If that’s the case, then that’s a way bigger problem.

Or (given the password database link at the end), is the sequence:

1) various logins are pwned (Google leak or just other logins, but using gmail as the email - if just other things, then password reuse?)

2) attacker has access to password

3) attacker phishes 2FA code for Google

4) attacker gains access to Google account

5) attacker gains access to Google authenticator 2FA codes

6) attacker gains access to stored passwords? (Maybe)

7) attacker gains the 2nd factor (and possible the first one, via the chrome password manager?) to a bunch of different accounts. Alternatively, more password reuse?

I guess the key question for me, was there password reuse and what was the extent, or did this not require that?

Disclaimer: work at Google, not related to security, opinions my own.

I think the attacker had my password, and they just needed a recovery method, which was the code I read over the phone.

I have no idea how they had my password, I never share passwords or use the same password. But I hadn’t changed my Google password in a while.

Passwords don't matter if you have access to the inbox and 2fa codes, you can just reset passwords.