> their screw-up was not doing MFA on their admin accounts MFA is not a silver bullet. You can still login with stolen cookies and 'replay' the session without

> their screw-up was not doing MFA on their admin accounts MFA is not a silver bullet. You can still login with stolen cookies and 'replay' the session without signing in.