62 million student records through a support portal with no second factor. Credit monitoring requires a credit file, and a nine-year-old has none.
No zero-day, no custom tooling, no organisation. One person in their late teens and a credential without MFA.