Many Organizations Have MFA. So Why Do Credential-Based Attacks Still Succeed?

Security news has been focused lately on sophisticated, AI-powered threats. But a recent breach at Chick-fil-A is a reminder that old-fashioned attacks relying on stolen credentials remain highly effective.

Multi-factor authentication has become a security operations standard; password managers are readily available, and passkeys are gaining traction in the industry. Yet attackers continue to successfully compromise user accounts using the same tactic for years: stolen credentials.

A recent example comes from Chick-fil-A, which disclosed that threat actors used credentials obtained from a third-party source to access customer loyalty accounts during an automated credential-stuffing attack.

The incident raises the question: Why do identity-based attacks continue to succeed despite years of investment in MFA and authentication technology?

The MFA Paradox: Why Credential Attacks Still Work In 2026

The success of these attacks cannot be attributed solely to a lack of MFA adoption. However, midsized organizations still trail large enterprises in deployment. JumpCloud data cited MFA adoption rates of roughly 34 percent among midsized firms versus 87 percent among organizations with more than 10,000 employees.

Instead, some reports indicate identity-based attacks keep succeeding because there are so many of them. Sophos’ latest State Of Ransomware report found that 80 percent of ransomware attacks now begin with compromised identities.

The abundance of identity attacks is underscored by data from Verizon’s 2026 Data Breach Investigations report. According to the report, credential abuse was found to be the leading initial access vector for threat actors. In fact, the report also found that stolen credentials edged out vulnerability exploitation.

Also, attackers are increasingly finding ways around incomplete MFA implementations. They do so through coverage gaps involving VPNs, firewalls, legacy apps, privileged accounts, and non-human identities rather than by the absence of MFA.

However, MFA alone may not be enough. Sophos found that 97 percent of incidents involving compromised credentials had MFA deployed to some extent.

“This wasn’t a case of attackers breaking in through an advanced exploit,” Ken Knapton, chief information officer at Win Brands, told MES Computing. “They walked through the front door using credentials people had already exposed elsewhere. That’s why identity has become the new perimeter.”

Another midmarket IT leader has questioned the need for any MFA.

“Instead of discussing traditional MFA, talk about implementing passwordless MFA solutions,” said Richard Richison, senior director, IT infrastructure & cybersecurity operations at Repligen Corporation.

“Traditional MFA solutions are becoming less effective, provide a false sense of security, and they’re a potential gateway for threat actors. IT leaders should be alarmed by how easily they can bypass it,” Richison said.

Perhaps the biggest reason why identity-based attacks continue to succeed is that they target human behavior rather than technology.

“Credential stuffing isn’t new, but it continues to succeed because it’s built around human behavior, not technical sophistication. CIOs should view this as a reminder to invest in layered identity controls rather than relying on passwords alone,” Knapton said.