I am so happy I am no longer responsible for these. We had a solid monitor and an analysis script that was quite good at dealing with the attacks. Then the fun

I am so happy I am no longer responsible for these. We had a solid monitor and an analysis script that was quite good at dealing with the attacks. Then the fun thing was that some lawyers concluded this is still a breach on success and that we should be responsible and report/mitigate these. How? How do you stop your users from making dumb decisions? The only solution seems to be to "give up" and go passwordless, putting the credentials to the big boys in town.