> Security is taken very seriously here at CircleCI ... > In the meantime, we will review our policies for enforcing 2FA on third-party accounts to the extent possible, and continue our transition to single sign-on (SSO) for all of our integrations

Well, if you had taken security seriously, the first thing you'd do is ensure 2fa on all accounts.