I don’t think it matters what 2fa the target had here, the attackers had him hook line and sinker. The bigger issue is that the attacker new everything about how the company worked internally, including staff. I would not be surprised if this company was already compromised, either from an external actor or internal.