We have no details so far, and the source is an MCP service dev.

This could be anything on the scale of vibesecurity issues to serious problems in the GitHub account recovery process, because (like most recovery processes) it is circumventable if you're dedicated.

Or they just fell for social engineering.