The password is 64 digits, randomly generated, and unique. And somehow they still got it. Google’s Titan Product just stopped my campaign emails from leaking. Take infosec seriously, everybody. If not for yourself, then for your colleagues.

Are you still able to log into it with your password? Curious if the password was reset somehow to a value the attacker knows.

Yes, I could before I changed it.

That doesn’t bode well, it means it was captured via phishing, sniffed via MitM, stolen via keylogger/malware, stolen from a place that has it stored, observed if you typed it in, or perhaps brute-forced. Regardless, that’s what 2FA is for, so congrats on excellent OpSec!

It is nearly impossible to brute-force 64 bits password.