How did you forget that you need to install 2FA on your personal phone which also requires that you have Microsoft Authenticator installed on your phone and manages to never be able to connect to your organization so you spend 2 hours on the phone with IT before they give you temporary access so you can reset your 2FA and start the whole process over again next month?
Unfortunately that argument didn’t work for Gary McKinnon
Edit: I guess it kind of did because the British government refused to extradite him because of that argument, so as long as the “hacker” is in Britain they will be fine.