A dump is chosen for extortion value, not evidence. This one disclosed its own method.
A stolen session token arrives after authentication. Multi-factor is not bypassed — it is never consulted.