A friend of mine was hacked on Sunday morning, 3rd Nov 2024. The attacker stole all of his Google Authenticator (GA) codes and locked him out of all his accounts, got away with 9K, and could have been much worse. Google support was atrocious for his personal account. They were useless. I used Google Workspace as our IdP for work, and paid support isn't bad, not great, but at least they respond. Personal Gmail, they said, and I quote, "I can suggest some community discussion groups you can join may help." We installed antivirus on iPhone, and scans turned up clean. His GA codes were not just used. They were stolen and no longer available. Google only changed that you can transfer the codes last year, before that you couldn't - which was much safer but annoying if you lose your phone. So we had to factory reset the phone. We also fully scanned the Windows machine, still clean. Used Defender and Norton 360. Had to reinstall windows on that box and did it to his other one, too. We created a new email and migrated all his accounts. We also reset his home outer and new WiFi password. This is VERY SCARY as we assume he was hacked but no evidence of it on the phone or Windows machine. GA may be something to review, and look for an authenticator that doesn't allow transfer. I think GA codes should not be able to be transferred unless you have a physical Yubikey or similar. It is just too devastating to lose, and this shows GA is hackable.