> MFA or not, this attack would've happened regardless. Yeah sorry, I shouldn't have implied otherwise/ should have been clearer about that. I just thought it

> MFA or not, this attack would've happened regardless. Yeah sorry, I shouldn't have implied otherwise/ should have been clearer about that. I just thought it was notable that admins were not using stronger 2FA. This is a company that owns password management, it seems like having proper auth should be a number one priority. Of course, once a session token is created you are past the initial point where a 2FA mechanism like a Yubikey would help. > if your run your own Keycloak Sure but I think most people would consider Google to be a far safer company than Okta, no? If not I think that they should be. TBH I feel like "session token used from a totally different computer/UA/IP/Region" is something Google may actually have caught.