Sounds somewhat concerning as it appears (from the survey) that a Hilton Customer Service rep may have helped the fraudsters to change key information on an account that has 2FA turned on and all that. WTH if true.

But then still send email to the original address on the account? Weird. Hope it pans out for the OP and no damage done.

Hotel chains really need to start setting up fraud hotlines that respond and act quickly 24/7 like banks and credit card companies do. Not like the black hole that this is today.