I'm guessing use of 2FA internally could have prevented this intrusion but that's a hassle so...