Strong passwords can be stolen through:
- Phishing emails
- Fake login pages
- Automated tools to guess passwords

Without 2FA, a hacker only needs your password to gain full access to your Google Admin account and your colleagues' information.