The compromised accounts weren't protected by multifactor authentication, spokesperson Rathschmidt said.