PowerSchool made a mistake in not enforcing MFA for its employees, especially those with access to sensitive data.