As said - you'll have to wait until Monday and the contact Sony. They should go through a load of security questions so he can prove he's the real owner etc.
As also said, 2FA is very important, especially as people generally don't take security that seriously.
This hack will not have been at Sony's end of things - so your brother-in-law has either reused passwords, been phished, has something keylogging him......potential list is endless. So ensure once the account is back under his control 2FA is the first thing he does.