Why else would you need to reset all of this if what I stated is not true? Your password, 2FA (except hardware tokens!), and all connected devices are compromised? Sure sounds like password hash, 2FA seeds, and tokens were stolen or leaked.