My Google Ads Account was hacked

Someone got into my google ads account although I have 2FA enabled and ran CPA ads for Nutra in Ukraine. Now there's a bill for 52-53£ and google tried charging my card. Luckily I had added card with no money in it. Just for verification purposes. I am still wondering how they got access. There's no sign of my email being logged into a different system or location. It's my personal email. And they ran ads. I never got any notification or anything. Has anyone else here ever faced this?