The organizations that got breached had strong identity programs