How Google Authenticator made one company’s network breach much, much worse