The security breach originated from a "misconfiguration" of the two-factor authentication (2FA) system.