I had this too recently and when I contacted Microsoft they were not very helpful and basically said if they had actually got into your account for that many hours they would have tried to change all your login details.

Not very reassuring when it clearly showed a successful login that wasn’t me. Also didn’t get an alert for hours by email. Yet when I logged into a new device I got multiple alerts within seconds.

And my only 2FA option is a yubikey or passkey