When multi-factor authentication succeeds and the attacker still gets in, you're not dealing with stolen passwords.