Put Stash Tab PIN

Due to ongoing hack which I think it is not isolated anymore, please put 2FA or at least Stash Tab PIN to secure account. My friend got hacked last night, after he bought a Headhunter, next day he got hacked. There is something going on that the hackers can get in the account. He received the unlocked code. Email is safe. No traces on the login history but still able to get his item.