What should be done if 2FA was turned off in an unexpected manner?

Question

Today when I logged in Facebook, no 2FA was shown.

I have been using SMS message as the second authentication factor. When I looked at the security settings, 2FA seemed to be disabled. I immediately set it up again, and performed the security check (change password, check phone number, posts, comments) offered by the "Not me" log-in option.

Since I usually use Facebook on semi-public computers, the account might be hacked. Are there any other things that I should do to protect the account?

I assume that there should be some SMS confirmation before succeeding in turning off 2FA, but I received none. Should I worry my phone's security? Also, although I didn't reuse my Facebook account password on other sites, are there other credentials I have to change?

Answer 1

The authentication token/cookie was probably saved and you were not prompted to login in with 2FA/MFA. Normally changing 2FA/MFA settings requires you to input a new OTP again so unless you're second factor was compromised you're most likely safe in terms of access to the account - data can have been stolen/compromised. Also consider using an option that is not SMS for 2FA/MFA like an authenticator app or yubikey (U2F).

More information
https://www.yubico.com/products/yubikey-hardware/
https://pages.nist.gov/800-63-3/sp800-63b.html
https://www.facebook.com/help/148233965247823/