99.9% of compromised accounts did not use multi-factor authentication