> At what point can we sue, especially if basic security practices like 2FA are not enabled? And if they are enabled ? Do you think this will make any differen

> At what point can we sue, especially if basic security practices like 2FA are not enabled? And if they are enabled ? Do you think this will make any difference ? We have, at work (Microsoft) 2FA enabled with Windows Hello. At setup it wanted to set a numeric pin. That's all. It asks from time to time about the second factor (Microsoft Authenticator) and that's all.