When attackers already have the keys, MFA is just another door to open

The article reports that a February 2026 Figure breach exposed ~967,200 email addresses and explains how that exposure enables large-scale credential stuffing, AI-driven targeted phishing, help-desk social engineering, and real-time phishing-relay (AiTM) attacks that can bypass common MFA methods; it concludes organizations need phishing-resistant, hardware-bound biometric authentication and promotes Token's solution.