How about a push to mandate 2fa for any entity holding data covered by GDPR or at the very least medical records. The United health care exploit was a password

How about a push to mandate 2fa for any entity holding data covered by GDPR or at the very least medical records. The United health care exploit was a password compromise as was the British library. The EPA just released a report saying 70% of the water infrastructure has laughable vulnerabilities like default passwords: https://www.newsweek.com/drinking-water-warning-issued-nationwide-cyberattacks-epa-1902756 https://www.newsweek.com/drinking-water-warning-issued-natio...