Could two factor authentication have stopped the hacker from exploiting the Elasticsearch vulnerability or from implementing the final "Smash and Grab" strategy?