It's blockchain.info, it's non-seeded so he doesn't have the 12 words.
If your funds actually exited your wallet there is nothing you can do, I assume that there is nothing to do with blockchain.info operators and it's probably your wallet/computer has been compromised.
It's a lesson to learn- next time if you store funds that you can't afford losing then do it on a hardware wallet offline, so you won't risk losing your funds due to lack of security.
Blockchain.info has the 12 word seed. The user owns the private keys and the seed. I think it's a good wallet, considering it's a online wallet....
Probably someone got access to his seed. As he uses 2FA, it's very unlikely the site had been hacked.
I asked a few times but he didn't answer how he stored his seed...