The core of the problem, a lot of paragraphs down:
> we have strong evidence that supports our hypothesis that the adversary gained access to our [DNS provider's] credentials through the compromise of a third party provider
> A factor which possibly helped the attacker was that the password had not been changed since 2013
> We chose our DNS provider 18 years ago when 2FA was neither a consideration nor a possibility
> we have strong evidence that supports our hypothesis that the adversary gained access to our [DNS provider's] credentials through the compromise of a third party provider
> A factor which possibly helped the attacker was that the password had not been changed since 2013
> We chose our DNS provider 18 years ago when 2FA was neither a consideration nor a possibility