Totally agree. Orgs with this kind of data will at least track geolocation and maybe device information and require proof despite a correct password as well as

Totally agree. Orgs with this kind of data will at least track geolocation and maybe device information and require proof despite a correct password as well as attempts to access multiple accounts from an address block. Many also incorporate the have I been owned leaked password database . The have to act responsible when handling and caring for this kind of data. It’s irresponsible not to.