Blog & Articles Your 2FA Backup Codes Are the Weakest Link, and Almost Nobody Audits Them by Rebecca Sutton September 15, 2026 by Rebecca Sutton September 15, 2026 A Russian state-backed campaign against Zimbra webmail went straight for 2FA backup codes, not passwords. Here is why that part of MFA gets ignored, and what to do about it. FacebookTwitterLinkedinEmail