> But would an account where an attempt was made, and failed, also count?

I wouldn't think so. There must be countless incorrect password attempts all the time.

> What if the userid and password are correct, but 2FA stopped the attack on an account. Is that account affected, in their view?

Interesting question. I'd hope they'd inform me if somebody had my password and was only blocked by 2FA.

Wouldnt you have gotten unexpected 2fa notifications if that were the case?

This is true only if you use SMS for 2FA.

For either method, you can audit the activity of your account on the GitHub security page: https://github.com/settings/security. For example, upon having deliberately got my 2FA token wrong, "user.two_factor_requested" and "user.failed_login" events were logged for me.

Interesting, I'd never checked that log before, and I just noticed a failed login (though no two_factor_requested) from an IP address in Brazil.

I'm gonna change my password just in case.

My guess is that all affected accounts are those that had multiple successful and/or unsuccessful login attempts coming from the same source.