in Massachusetts. It was probably a VPN... They set up an external back transfer. Mountain America guessed they stole our login credentials.... Somehow they added a second email for two-factor authentication (under a name I don't recognize).

3 people had access to the account (I lowered it to just me after the incident). The other two are both doing well in their careers... I don't see a motive and they're pretty trustworthy (both have donated quite a bit to us in the past).

Short answer is I don't think so, but MACU is investigating so I would hope they would be able to find if there's foul play. It looks unlikely so far.