This can't be true. They already admitted to not having 2FA enabled. The SEC openly lying. 
nostr:nevent1qqsr80z3l9cdlx2ek6wjnjaacp0zxzpeugmzun507t93479meu4444spp4mhxue69uhkummn9ekx7mqzyqhdhn4xjngkgc5c2jjjtq693ltdjed3v83ufz6h6whlqx2q2kyggqcyqqqqqqgl3cku3