Even if one account is compromised, they have to send that notification. So I wouldn't be so worried about it. Some credentials stuffing attack gained access to a few accounts protected by a password like 123456. TurboTax has 2FA support.