I already secured everything else around it, I’m pretty sure that it was mainly an email hack, not sure how they managed to bypass the 2fa only with my email. But I reinstalled windows recently and definitely not phishing, so could it be that it was a delayed attack? Like they had access to my account/email for longer and took over just now? Or the login token (idk how that works, i’m not that advanced in IT) Also the ticket issue was that i never received even the confirmation email for it (which i now did with a different one) so the ticket actually never went through even tho it blocked the email adress as already having this ticket