What if a password your employee hasn’t used in years was still enough to access your systems? A recent attack shows why MFA is no longer optional.