It happened to me. Hacker changed the account email address so I couldn't see anything. Called immediately.
Took a lifetime to get resolved, and when it was unlocked, I had to call again because the hacker changed the country to Norway and I couldn't change it back online.
Very friendly call centre agent remarked 'it's amazing what hackers can do nowadays'. I mentioned how it's not particularly difficult when something so valuable doesn't have two-factor authorisation.
I'm sure two-factor will come at some point around 2030. We'll get TSA-Precheck around that time, too.