“In one engagement, attackers compromised an RSA Security server, extracted soft token seed files, and bypassed two-factor authentication by exploiting the use of a single, non-unique password for all seed files.”