Make 2FA mandatory for users who were breached or are using passwords that are in known password lists.

I don't know how much you spent in support, but U2F Zeros are dirt cheap. You could probably just proactively mail them to your clients and encourage them to use 2FA.

Or offer discounts or other perks to users with 2FA.