Social engineering will almost always work. I don't really fault Sendgrid for this (though I could see this not working as well if you were using Amazon SES...no support to even talk to!). It sucks that they got caught with their pants down but I bet a good social engineering attempt on ChunkHost might have yielded similar results.
The lesson here is to have multiple defenses. 2 factor auth is a great start and it worked in this case.
The lesson here is to have multiple defenses. 2 factor auth is a great start and it worked in this case.