Tag Archive for: Multi-Factor Authentication

Multi-factor authentication gets recommended constantly, but the reasoning behind it often gets lost in vague advice like “add another layer.” The more useful question is narrower: which specific attacks does MFA actually stop, and which ones can still slip through if it is set up the wrong way? Most breaches do not start with a sophisticated exploit. They start with a password that was reused, guessed, or bought on a criminal marketplace, then simply typed into a login page.

Microsoft’s 2025 Digital Defense Report puts a number on the upside: phishing-resistant MFA blocks over 99% of identity-based attacks, even when an attacker already has a valid username and password. Here is what that protection actually covers, threat by threat, what it costs a business when that protection is missing, and where the gaps still are, so the next MFA decision is based on evidence rather than a generic best-practice checkbox.

How MFA Blocks an Attack (Quick Refresher)

Most attacks that compromise accounts rely on one thing: a password. Once an attacker has it, whether through a breach, a phishing email, or simple guessing, single-factor login hands over full access with nothing else standing in the way. Multi-factor authentication breaks that chain by requiring a second, independent proof of identity, something the attacker is unlikely to also possess, like a push approval on a registered device, a one-time code, or a biometric scan. Because that second factor lives somewhere entirely separate from the password itself, compromising one no longer means compromising the account. For the full mechanics, see our complete guide to how MFA works.

Credential Stuffing and Password Spraying

Credential stuffing takes usernames and passwords leaked in one breach and tests them against other services, betting on password reuse. It is not a rare edge case. Verizon’s analysis of enterprise single sign-on logs found that credential stuffing traffic made up a median of 19% of all authentication attempts, and that only about 49% of a typical user’s passwords are actually distinct from one another, meaning a breach at almost any unrelated service can hand an attacker a working password for your systems. Password spraying works the other direction, trying a handful of common passwords against many accounts to avoid triggering account lockouts. Microsoft reports that roughly 97% of identity-based attacks it observes are password spray or brute force attempts, and that phishing-resistant MFA eliminates them outright, since a correct password alone still is not enough to get in. Both attacks are cheap to run at scale and entirely automated, which is exactly why they target the weakest link in an organization’s authentication setup first. Our guide on credential stuffing attacks walks through detection and prevention in more detail.

Brute Force Attacks

Brute force attacks systematically guess passwords, either through simple trial and error or dictionary based tools that cycle through common patterns and previously leaked passwords. NIST’s Special Publication 800-63B addresses this directly at the verifier level, requiring systems to rate limit and throttle failed login attempts, generally capping automated guessing at no more than 100 consecutive failures. That throttling alone slows an attacker down considerably, but it does not close the door completely, since a determined attacker with a large enough list of targets can still eventually land a hit across thousands of accounts. MFA adds a second, independent barrier on top of that throttling: even a correctly guessed password fails to grant access without the second factor, which is what turns a slowed-down attack into a fully blocked one. See our full breakdown of brute force attack types and prevention for the technical detail.

Phishing (With an Important Caveat)

Standard MFA blocks a large share of phishing attempts, since a stolen password alone is not enough to log in. But not all MFA is equally resistant. Adversary in the middle phishing kits can relay a one-time code or push approval in real time by sitting between the user and the real login page, capturing both the password and the second factor as the user enters them. This is why Microsoft’s guidance specifically emphasizes phishing-resistant MFA, such as FIDO2 or passkeys, rather than MFA in general, since those methods bind the credential cryptographically to the legitimate site and cannot be relayed the same way. Our post on phishing-resistant MFA vs. standard MFA explains the distinction, and our guide to protecting your business from phishing covers the broader defense strategy beyond authentication alone.

The Real Cost When a Stolen Credential Gets Through

The financial argument for closing these gaps is not abstract. IBM’s 2025 Cost of a Data Breach Report found the global average cost of a breach was $4.44 million, and breaches where compromised credentials were the initial access point averaged $4.67 million, with organizations taking roughly 246 days on average to identify and contain them. That gap between “a password leaked somewhere” and “someone noticed” is exactly the window MFA is designed to close, since a stolen password alone stops being useful the moment a second factor is required to act on it. For businesses evaluating whether the deployment effort is worth it, that is the comparison that matters: the cost of enforcing MFA against the cost of a multi-million dollar breach that started with one reused password.

Account Takeover After a Third-Party Breach

A breach at one company routinely fuels attacks on accounts elsewhere, since so many people reuse the same password across services. The FBI’s Internet Crime Complaint Center received over 1,008,000 complaints in 2025 with reported losses of nearly $21 billion, and phishing and spoofing remained among the most frequently reported categories. When a password from an unrelated breach eventually reaches your login page, MFA is what stops that stolen credential from becoming an actual account takeover. This is precisely the scenario why MFA is critical in cybersecurity beyond compliance checkbox reasons.

What MFA Does Not Stop On Its Own

Honesty matters here as much as the upside does. Standard MFA is not immune to every technique. Attackers have adapted with MFA fatigue attacks, which flood a user with repeated push approval requests until one gets accepted out of frustration or confusion, and with real-time phishing proxies that intercept both the password and the one-time code at the moment of login. Our posts on MFA fatigue and how hackers bypass 2FA cover these techniques and how to close the gaps. The short version: the method of MFA matters more than simply having MFA turned on. SMS and basic push notifications are useful and far better than a password alone, but phishing-resistant methods close far more of the remaining gap and remove the human decision point that push fatigue exploits.

Choosing MFA That Closes These Gaps

The data points to one practical takeaway: MFA works, but the strength of the factor determines how much protection an organization actually gets, and how much of that $4.67 million average credential-breach cost stays theoretical rather than real. OmniDefend’s MFA platform supports OTP, push, biometrics, smart cards, and FIDO2/WebAuthn passkeys in a single deployment, so organizations are not locked into the weakest option by default. It integrates with Active Directory, cloud platforms, and existing business applications, whether deployed on premise or in the cloud, and pairs naturally with single sign-on for industry specific needs like healthcare and financial services compliance.

Stop the Attacks That Actually Target Your Accounts

Credential stuffing, brute force, and phishing all rely on the same weak point: a password used alone. OmniDefend closes that gap with layered, phishing-resistant authentication built for real deployments, not just demos. Start your 30-day free trial and see how it fits your environment, no credit card required.

Frequently Asked Questions

1. Does MFA stop all cyberattacks? 

No. MFA blocks the large majority of identity-based attacks, including credential stuffing, brute force, and password spraying, but techniques like MFA fatigue and real-time phishing proxies can still succeed against weaker MFA methods. Phishing-resistant options like FIDO2 and passkeys close most of that remaining gap, which is why the choice of method matters as much as the decision to enable MFA at all.

2. What is the most common attack MFA prevents? 

Credential-based attacks, including credential stuffing and password spraying, are the most common attacks MFA prevents, since these rely entirely on a stolen or guessed password being sufficient on its own. Microsoft attributes roughly 97% of the identity-based attacks it tracks to this category.

3. Is SMS-based MFA enough to stop these attacks? 

SMS-based MFA stops far more than no MFA at all, but it is more vulnerable to interception and SIM-swap attacks than app-based or hardware-based methods. NIST classifies SMS as a restricted authenticator for this reason, meaning it is still allowed but requires additional risk mitigation for sensitive systems.

4. Why does the type of MFA matter if any MFA blocks most attacks? 

Because attackers adapt to the weakest widely deployed method. As more organizations adopt basic MFA, techniques targeting SMS interception and push fatigue have grown alongside it, which is why phishing-resistant methods are increasingly recommended for high-value accounts and privileged users.

5. How quickly should a business move from passwords alone to MFA? 

Given that credential-related breaches average 246 days to identify and contain, and cost hundreds of thousands of dollars more than a typical breach, most security guidance treats MFA as an immediate baseline control rather than a future project, particularly for admin accounts, finance systems, and anything holding customer data.

Sources

• Microsoft Digital Defense Report 2025
• Verizon Data Breach Investigations Report
• FBI Internet Crime Complaint Center, 2025 Internet Crime Report
• NIST Special Publication 800-63B, Digital Identity Guidelines
• IBM Cost of a Data Breach Report 2025

Most breach case studies involve a chain of failures. This one did not need a chain. A single remote access portal without multi-factor authentication was enough to trigger the largest healthcare data breach in US history, one that has now cost UnitedHealth Group more than $3.6 billion and affected roughly two out of every three Americans.

Here is exactly what happened, what it has cost so far, and the one lesson every business should take from it.

What Happened: A Timeline

• February 21, 2024: Attackers used stolen credentials to remotely access a Citrix portal belonging to Change Healthcare, a UnitedHealth Group subsidiary that processes a large share of US healthcare claims and payments. In testimony before Congress, CEO Andrew Witty confirmed the portal did not have multi-factor authentication enabled.
• Nine days later: After moving laterally through internal systems and exfiltrating data, the attackers, identified as the ALPHV/BlackCat ransomware group, deployed ransomware, forcing Change Healthcare to shut down its network to contain the damage.
• The ransom: UnitedHealth confirmed paying $22 million to the attackers. The group then exit-scammed its own affiliate, who took a copy of the stolen data to a second extortion group, RansomHub, which posted portions of it on the dark web demanding an additional payment.
• The scope grew for over a year: Initial disclosures cited roughly 500 affected individuals. That estimate rose to 100 million by October 2024, then to approximately 190 million by January 2025, and to 192.7 million by July 2025, nearly two-thirds of the US population and the largest healthcare breach ever recorded.

The Root Cause: One Missing Control

The technical details of this breach are almost beside the point. Attackers did not need a sophisticated exploit or a zero-day vulnerability. They needed one working set of stolen credentials and one remote access point that only checked a password. Every other security control Change Healthcare had in place, and a company of its size had many, became irrelevant the moment that single portal let a password stand in for identity verification.

This is precisely the scenario covered in our breakdown of what cyberattacks MFA actually stops: credential-based attacks work exactly once, at exactly the point where a second factor should have been required and wasn’t. It is worth being specific about why this particular gap was so damaging. Change Healthcare processes roughly one in three US patient records, meaning a single compromised portal did not just expose one organization’s data, it created a single point of failure for a meaningful share of the entire country’s healthcare claims infrastructure.

The Ripple Effect on Healthcare Providers

The damage did not stop at UnitedHealth Group’s own balance sheet. The American Medical Association surveyed more than 1,400 physician practices in the weeks after the attack and found the disruption threatened the financial survival of many of them. Eighty percent of practices reported lost revenue from unpaid claims, 85% had to dedicate additional staff time just to manage revenue cycle tasks manually, and 36% saw claim payments suspended outright. Nearly half of practices were forced into new, often costlier arrangements with alternative clearinghouses just to keep processing claims. A separate American Hospital Association survey found 94% of hospitals reported a financial impact, with almost 60% losing $1 million or more in revenue per day at the height of the disruption. One physician told the AMA the incident was “leading me to bankruptcy.” This is the part of a breach that rarely makes the initial headlines: the direct victim’s costs are only part of the story when that victim sits at the center of an entire industry’s payment infrastructure.

The Cost, By the Numbers

Those figures come directly from UnitedHealth Group’s SEC filings, not third-party estimates, and they do not include the cost of ongoing litigation, which has not yet been resolved.

The Aftermath: Regulatory and Legal Fallout Is Still Unfolding

The consequences extend well beyond the initial response costs. The Department of Health and Human Services’ Office for Civil Rights opened a HIPAA compliance investigation into Change Healthcare and UnitedHealth Group, notably before Change had even formally reported the breach, an unusually proactive move that signals how seriously regulators are treating the incident. A multidistrict litigation is currently active in the US District Court for the District of Minnesota, with a pretrial scheduling conference held in early 2026 and settlement discussions between plaintiffs’ and defense counsel ongoing. Nebraska’s Attorney General separately sued Change Healthcare, UnitedHealth Group, and Optum, alleging violations of the state’s consumer protection and data privacy laws, a lawsuit that survived a motion to dismiss and is proceeding toward further hearings. As of early 2026, no global settlement has been reached. For comparison, the 2015 Anthem breach, which affected 78.8 million people, roughly a third of this incident’s scale, settled for $115 million in 2017. Legal experts widely expect any eventual Change Healthcare settlement to be considerably larger, given the difference in scale and the ongoing regulatory scrutiny.

The Lesson for Every Business

The takeaway is not “healthcare companies need better security.” UnitedHealth Group operates a large, well-resourced security program, and the vast majority of its systems were presumably protected far better than this one portal. The takeaway is narrower and more uncomfortable: partial MFA coverage is not real MFA coverage. A remote access portal, a legacy system, a third-party integration, or a vendor-facing login that gets overlooked during rollout is exactly the kind of gap attackers look for, and one gap is all a credential-based attack needs. Attackers do not need to find a weakness in your strongest system. They only need to find your weakest one. Our guide on the pros and cons of enabling MFA covers how to think through coverage systematically rather than account by account, and our post on how hackers bypass 2FA covers the specific techniques worth defending against once basic coverage is in place.

How OmniDefend Closes This Exact Gap

The failure point in this breach was a remote access portal, exactly the kind of system organizations sometimes treat as lower priority than customer-facing applications, precisely because it is used internally rather than by the public. That assumption is backwards: internal and remote access systems are often the ones attackers target first, since they frequently carry broad permissions and receive less scrutiny than anything customer-facing. OmniDefend’s MFA platform is built to close that specific blind spot, applying consistent multi-factor enforcement across remote access, internal systems, and cloud applications alike, rather than leaving coverage decisions to be made system by system or team by team. For healthcare organizations specifically, OmniDefend also supports HIPAA-aligned identity and access management built for the exact compliance requirements this scenario triggered.

Don’t Let One Overlooked System Become Your Breach Story

A single portal without MFA cost one company over $3.6 billion and counting. Closing that kind of gap does not require a multi-year overhaul. Start your 30-day free trial of OmniDefend and see how quickly full-coverage MFA can be in place across every access point in your organization, no credit card required.

Frequently Asked Questions

1. What caused the Change Healthcare breach? 

Attackers used stolen credentials to log into a Citrix remote access portal that did not have multi-factor authentication enabled, then moved laterally through internal systems before deploying ransomware.

2. How many people were affected? 

UnitedHealth Group’s most recent disclosure, as of July 2025, put the number at approximately 192.7 million individuals, making it the largest healthcare data breach recorded in the United States.

3. Did UnitedHealth pay the ransom? 

Yes, the company confirmed paying $22 million to the attackers. A second group later claimed to also possess the stolen data and attempted to extort an additional payment.

4. Has the Change Healthcare breach been settled? 

As of early 2026, no global settlement has been reached. Litigation is ongoing in a multidistrict case in Minnesota, along with separate state-level lawsuits, and a HIPAA investigation from HHS remains open.

5. How can businesses avoid a similar breach? 

Apply multi-factor authentication consistently across every system that can be reached remotely, not just the ones considered highest priority. Attackers specifically look for the system that was left out of the rollout.

6. Why did this breach affect so many providers beyond UnitedHealth itself? 

Change Healthcare processes roughly one in three US patient records and sits at the center of claims processing for a large share of the healthcare industry. When it went offline, the disruption cascaded to physician practices and hospitals nationwide that depended on it to get paid, independent of whether their own systems were ever compromised.

Sources

• UnitedHealth Group 10-K, Fiscal Year 2024 (SEC filing)
• UnitedHealth Group 8-K, Fiscal Year 2025 Q4 Results (SEC filing)
• Nixon Peabody: Change Healthcare Cybersecurity Breach Impact on Healthcare Providers
• Security.org: Change Healthcare Data Breach, What Happened and What to Do
• American Medical Association: Physicians Struggle to Keep Practices Afloat After Change Cyberattack

If you’re weighing whether multi-factor authentication is worth the rollout headache, the honest answer is that the decision was mostly made for you a couple of years ago. Cyber insurers won’t underwrite you without it. Auditors flag its absence before almost anything else. And 2026 has already delivered a reminder of how fast the threat side of this moves, in March, Microsoft and Europol seized 330 domains behind Tycoon 2FA, a phishing-as-a-service kit responsible for roughly 96,000 victims since 2023, only for competing kits to absorb its market share within weeks. The breach data has gotten so lopsided that “we didn’t have MFA on that account” has become the single most common line in post-incident reports.

That doesn’t mean MFA is a switch you flip and forget, it isn’t, and we’ll get into exactly where it falls short further down. Here’s what the current evidence actually says, not the recycled talking points on most vendor blogs.

The short version:

• Stolen credentials are still the #1 way attackers get in, involved in 22% of all breaches and 88% of basic web application attacks
• MFA blocks over 99.2% of account compromise attempts when enforced properly
• It’s now a baseline requirement for cyber insurance, not an optional upgrade
• Not all MFA is equally safe, SMS and push notifications are phishable; the MGM Resorts breach happened with MFA in place.
• Small businesses get hit harder than enterprises, not less, 88% of SMB breaches involved ransomware vs. 39% at large firms.

Passwords Were Never Really Working

Worth being blunt about the baseline you’re improving on.

In Verizon’s 2025 Data Breach Investigations Report, built from over 22,000 incidents, the industry’s largest annual dataset, stolen or compromised credentials were the leading initial access vector for the second year running, involved in roughly 22% of breaches. For basic web application attacks specifically, that number jumps to 88%.

A few numbers from the same report explain why:

• Only 3% of compromised passwords met basic complexity requirements
• The median user reuses roughly half their passwords across different services
• 2.8 billion stolen passwords were posted for sale or given away on darknet markets in 2024 alone

That reuse rate is exactly why credential stuffing works as well as it does, it’s essentially free reconnaissance for attackers, using data that’s already been stolen elsewhere. A password, on its own, is a single point of failure that a huge black market already trades in. Once it’s in a breach dump, it stops mattering how “strong” it was when you picked it.

MFA doesn’t eliminate this problem, but it changes the math dramatically:

• 99.2%+ of account compromise attempts blocked when MFA is enforced
• 99.9%+ of compromised accounts turned out to have no MFA enabled at all
• An independent academic study using real compromise benchmarks landed in the same range, estimating better than 99% risk reduction for MFA-protected accounts.

That’s the case for MFA in a nutshell. Everything below is the detail, and the parts of the pitch that usually get glossed over.

What “Multi-Factor” Actually Means

Quick grounding, since the term gets used loosely. MFA requires at least two of three independent categories before granting access:

The security value comes from independence. Steal a password through a phishing kit, and you still don’t have the phone or the fingerprint, in theory. That holds up well against credential-stuffing and password-spray attacks. It holds up less well against a specific attack pattern covered further down, because not every “second factor” is built the same way. A text message and a hardware security key both technically satisfy “MFA,” but they don’t offer remotely the same protection.

For the full breakdown of how SMS, authenticator apps, push notifications, and hardware keys compare, see Common MFA Authentication Techniques and What is Dual Factor Authentication and How Does It Work.

The Benefits, With the Numbers Behind Them

It closes the gap doing the most damage right now.

Credential abuse isn’t a niche attack pattern, it’s the dominant one, and has been for years. Every additional factor an attacker has to defeat is typically a factor they don’t have, because most credential theft happens at scale (phishing kits, infostealers, purchased breach dumps) rather than through targeted device compromise. This is the core reason MFA adoption moved from “recommended” to “assumed” across the industry.

Enterprise risk is mostly about scale, not sophistication

Large organizations don’t get breached because attackers are smarter about them. They get breached because they have more accounts, more privilege tiers, and more entry points, a single compromised low-privilege account is often enough to pivot laterally into something valuable.

• Global average breach cost: $4.44 million, down slightly on faster AI-assisted detection
• Breaches involving a malicious insider: $4.92 million, the most expensive category
• Healthcare: $7.42 million per incident, its 15th straight year as the costliest industry
• US average: $10.22 million, more than double the global figure, driven by regulatory penalties and slower detection

For a large corporation, MFA is often the thing standing between “an employee’s password leaked in an unrelated breach” and “an attacker inside the finance system.”

Small businesses are the primary target, not an afterthought

The common assumption is that attackers go after big companies because that’s where the money is. The data says the opposite, automation makes small businesses the easier target, and attackers optimize for ease over size.

• Ransomware present in 88% of small-business breaches vs. 39% at large enterprises
• SMBs saw roughly 4x the confirmed breach volume of larger organizations in the same period
• Average SMB breach cost: $3.31 million
• 40% of small businesses say a $100,000 incident would put them out of business entirely

If you’re running a smaller operation and treating MFA as an enterprise-only concern, the incident data doesn’t support that. For a practical rollout path without an internal security team, see Implementing Multi-Factor Authentication for Small Businesses.

It’s now a cyber insurance prerequisite, not a nice-to-have

This shifted hard over the last two renewal cycles. MFA enforcement across email, VPN, remote access, and privileged/admin accounts is now a baseline underwriting requirement at essentially every major carrier. Coalition, one of the largest cyber insurers, found that over half of all 2024 claims originated from business email compromise or funds transfer fraud, exactly the access-control failure MFA is designed to close, which is why insurers now scrutinize it so closely at renewal.

Checking the box isn’t enough anymore, either:

• Insurers increasingly ask whether MFA is phishing-resistant specifically
• They want confirmation it’s enforced across every privileged account, not just mailboxes
• Carriers have started denying or disputing claims post-breach when forensics show MFA wasn’t actually in place as claimed on the application

A gap on one global admin account is exactly the kind of thing a post-incident audit finds, and it’s the difference between a covered claim and a denied one.

Third-party and vendor access is a growing blind spot

Third-party involvement in breaches climbed to roughly 30% of all cases in Verizon’s 2025 DBIR, nearly double the year before. Enforcing MFA on vendor, contractor, and integration accounts closes a door a surprising number of organizations leave open, because internal and external accounts often get treated as separate risk categories when they shouldn’t be. Full breakdown in Third-Party Authentication Risks and How to Mitigate Them.

It simplifies access management more than people expect

Rarely makes the headline pitch, but MFA paired with single sign-on genuinely reduces IT’s operational burden over time:

• Fewer password reset tickets
• Centralized deprovisioning, one deactivation instead of hunting down a dozen app-level accounts when someone leaves
• Cleaner audit trails for who accessed what, and when

Where MFA, SSO, and 2FA overlap (and where they diverge, since the terms get used interchangeably and shouldn’t be) is covered in SSO, 2FA And MFA: Pros And Cons, Difference And More.

Adaptive MFA fixes the friction complaint, if it’s implemented that way

The oldest objection to MFA is that it slows people down. That’s mostly aimed at static MFA, which challenges every login identically regardless of context.

Risk-based (adaptive) authentication evaluates device, location, network, and time of day, and only prompts for a second factor when something looks unusual. A login from a recognized device on a recognized network passes through with minimal friction; a login attempt from a new country at 3 a.m. gets challenged harder. This is increasingly the expected default in modern IAM deployments, not an advanced add-on.

Zero Trust doesn’t function without it

If your organization is moving toward Zero Trust, “never trust, always verify,” no implicit trust based on network location, MFA is a structural requirement, not an enhancement. Continuous identity verification is the whole premise of Zero Trust, and a single-factor login undermines that premise at the first step. It’s also why insurers, as noted above, have started asking about Zero Trust principles directly rather than treating MFA as a standalone checkbox.

Where It Falls Short, the Part Most Articles Skip

This is where implementation decisions actually get made, not just the “should we adopt it” decision.

Not all MFA resists phishing equally

SMS codes and basic push notifications are shared secrets or approval taps, both interceptable, relayable, or sociable-engineerable. Adversary-in-the-middle phishing kits now steal authenticated sessions in real time. One phishing-as-a-service platform, Tycoon 2FA, accounted for 62% of the phishing volume Microsoft blocked by mid-2025, including more than 30 million fraudulent emails in a single month.

The March 2026 takedown, and why it didn’t end the problem: the Tycoon 2FA seizure mentioned above disrupted infrastructure that had processed more than 30 million fraudulent emails in a single month at its peak. But within weeks, competing phishing-as-a-service kits, Mamba 2FA, EvilProxy, Sneaky 2FA, absorbed the market share Tycoon 2FA left behind, and Tycoon 2FA itself was rebuilt on new infrastructure by May 2026. It’s a clean illustration of the underlying problem: taking down one operation doesn’t retire the technique. MFA methods that are vulnerable to session-token theft will keep getting targeted by whichever kit currently leads the market.

FIDO2 and WebAuthn-based authentication, hardware keys, platform passkeys, are cryptographically bound to the legitimate site’s origin, which makes them resistant to this attack class in a way OTP codes fundamentally aren’t. If your organization handles anything sensitive, the gap between “MFA” and “phishing-resistant MFA” is worth taking seriously, not treating as a technicality. Protocol comparison here: SAML vs OAuth vs OpenID: Key Differences.

MFA fatigue attacks are a documented, repeatable failure mode

The mechanism is simple: an attacker who already has a valid password bombards the victim with push notification requests until, out of irritation or confusion, someone taps “approve.”

This isn’t theoretical:

• It opened the door in Uber’s 2022 breach
• It hit Cisco the same way
• It was the entry point for the September 2023 MGM Resorts breach, the push-fatigue attempt was followed by a phone call to MGM’s help desk, where an attacker impersonating an employee (using details pulled from LinkedIn) convinced staff to reset that employee’s MFA entirely. The resulting ransomware shut down slot machines, hotel key systems, and booking platforms, with losses estimated above $100 million

The lesson from MGM isn’t “MFA failed”, MFA was in place. The lesson is that the recovery and reset process around MFA is often less protected than the login itself, and attackers have learned to target that seam instead of the cryptography.

More on the pattern and how to blunt it: MFA Fatigue: What It Is & How to Respond and MFA Exemptions: How to Handle “Exempt” Users Without Creating a Security Hole.

There’s a real cost and change-management burden

Rolling out MFA org-wide means licensing decisions, hardware for high-privilege accounts if you go the security-key route, help desk load during onboarding, and, inevitably, a subset of users who resist the extra step. None of this is a reason to skip MFA. It’s a reason to budget for adoption as a project with a timeline, not a policy you flip on overnight.

Device dependency creates its own recovery problem

If MFA lives entirely on one device and that device is lost, stolen, or just out of battery, you need a break-glass process that doesn’t itself become the weak point. The standard mitigation is a dedicated, tightly monitored emergency-access account, excluded from standard policy but watched closely, not a “call the help desk and answer three questions” fallback.

Choosing an Approach That Actually Holds Up

• Prioritize phishing-resistant methods for anything privileged. Admin accounts, financial systems, and anything with broad access should sit behind FIDO2/WebAuthn or platform passkeys, not SMS or basic push.
• Treat fallback methods as your actual attack surface. A strong primary factor doesn’t help if “forgot my device” quietly downgrades a login to a weaker one. Audit what happens when the primary method fails.
• Lock down the reset and recovery path as tightly as the login itself. The single biggest lesson from the MGM-style breaches, the help desk, not the cryptography, was the weak link.
• Use adaptive, risk-based challenges so you’re not creating friction on low-risk logins while still catching the ones that matter.
• Consider where passwordless fits. For many organizations, the long-term direction isn’t “MFA on top of a password” but authentication that removes the password as a shared secret entirely. Covered in Passwordless Authentication: How It Works & Benefits and Passwordless vs Multi-Factor Authentication: Difference.

If you’re building or refreshing an identity and access management strategy from scratch, MFA is one piece of a broader architecture that usually includes SSO, cloud-based IAM, and centralized policy enforcement. See Integrated Enterprise Security Solutions: IAM, MFA, SSO, and Beyond and What Are Cloud-Based IAM Solutions? For which specific MFA methods are getting the most enterprise adoption right now, see Top Multi-Factor Authentication Options for Business Security in 2026.

None of this has to mean stitching together five different point solutions and hoping they work well together. That is usually where MFA rollouts stall or end up with the exact fallback gaps described above. OmniDefend brings MFA, biometric authentication, and single sign on under one platform, so the phishing resistant methods and the recovery path safeguards this article argues for are not an extra integration project on top of everything else. They are just how the system works out of the box. Start a 30 day free trial and see exactly where the gaps are in your current setup, before an attacker does. 

FAQs

1. Is MFA actually required by law, or is it just recommended? 

Depends on your industry and jurisdiction, it isn’t a single blanket mandate. PCI DSS now explicitly requires MFA for access to cardholder data environments (the broader requirement took effect March 31, 2025), and frameworks like HIPAA push it as an expected control even where it isn’t spelled out line-by-line. Separately, most cyber insurance carriers now require it contractually, which functions as a de facto mandate for any business carrying a policy.

2. Does MFA slow down employee logins? 

Static MFA that challenges every login identically does add friction. Adaptive, risk-based MFA, which only prompts for a second factor when a login looks unusual, largely solves this, since routine logins from recognized devices pass through with minimal interruption.

3. Can MFA be bypassed? 

Yes, worth being direct about that rather than overselling MFA as unbreakable. SMS and push-based MFA can be defeated through real-time phishing kits, SIM swapping, or fatigue attacks that exploit human patience rather than the cryptography. Phishing-resistant methods (FIDO2 hardware keys, platform passkeys) close most of these gaps, but only if fallback methods to weaker factors are also removed or tightly restricted.

4. What’s the difference between MFA and two-factor authentication (2FA)? 

2FA is technically a subset of MFA, exactly two factors. MFA is the broader term and can involve two or more. Most business deployments use two factors, so the terms get used interchangeably, but MFA is the more accurate umbrella term once a third factor (like biometrics on top of a password and a device) enters the picture.

5. Do small businesses really need MFA, or is that overkill for a small team? 

The breach data says small businesses need it more urgently than large enterprises, not less, SMBs see a higher rate of ransomware in confirmed breaches and typically have far less capacity to absorb the cost of an incident. Size doesn’t reduce the risk; it reduces the resources available to recover from it.

6. What’s the single biggest mistake organizations make when rolling out MFA? 

Leaving the account-recovery and help-desk reset process weaker than the login itself. Several of the highest-profile breaches of the last few years, including MGM Resorts, didn’t happen because MFA was defeated cryptographically, they happened because an attacker convinced a support employee to reset it.

Sources

• Verizon, 2025 Data Breach Investigations Report
• Microsoft, Plan for mandatory Microsoft Entra multifactor authentication
• Microsoft, Security at your organization: MFA statistics, Partner Center
• Microsoft, “Defending the gates”: Tycoon 2FA disruption
• The Hacker News, Europol-Led Operation Takes Down Tycoon 2FA
• IBM, Cost of a Data Breach Report 2025
• Coalition, 2025 Cyber Claims Report
• Insurance Business America, Coalition publishes 2024 cyber claims report
• Infosecurity Magazine, Verizon DBIR: Small Businesses Bearing the Brunt of Ransomware Attacks
• StationX, Small Business Cybersecurity Statistics and Trends 2026
• Dark Reading, MGM and Caesars Attacks Highlight Social Engineering Risks
• arXiv, “How effective is multifactor authentication at deterring cyberattacks?”