iCloud or Mailbox.org - one was hacked

What exactly was the notification you received? You can generate iCloud MFA messages without knowing the password. Attackers commonly do this and then call you spoofing an Apple Support phone number to try and gain access under the guise of helping protect your account. All the communications appear legitimate since the MFA message is and the phone number is spoofed to a real Apple Support number, but it might actually be that no one ever got access to anything. I still recommend rotating credentials, etc. to be safe.