Hacker News Reader

Why would the attacker having your Mercury TOTP mean they most likely have access to your email?

Because my TOTPs are all stored in the same device and in my imaginary scenario they have that.