While SMS verification can be defeated by a targeted attack, Google’s ability to do things like send a prompt to a connected phone or have users verify where they last log in also help block sign-ins it thinks are suspicious. If you’re logging in on a brand new device or from a new location, then you should expect a little more scrutiny, however because 38 percent of users didn’t have access to their phone, and 34 percent couldn’t get to a secondary email address, the worry is that requiring challenges all the time will increase account lockouts.

According to the Google data, “hack for hire” attacks that impersonate familiar people or Google itself are incredibly rare, but can include multiple attempts even after an initial message is rebuffed. That’s where steps like its Advanced Protection Program — that requires a user to setup two hardware keys and use one of them to login all the time — come in handy.

Mirroring the results Google has seen since requiring employees to use hardware keys, researchers said zero users who exclusively use security keys — despite the presence of a flaw that’s caused a recall of Google’s Bluetooth Titan Key — had fallen victim to targeted phishing. Limiting the attack surface based on physical proximity, and because a site has to verify itself to the security key, keeps phishing attacks at bay, even for people who are being targeted specifically.

UK Foreign Secretary Jeremy Hunt in a statement called the move “decisive action” to deter future cyber attacks. “For too long now, hostile actors have been threatening the EU’s security through disrupting critical infrastructure, attempts to undermine democracy and stealing commercial secrets and money running to billions of Euros,” said Hunt.

Russia and China regularly engage in cyber warfare against the EU and other nations, and were behind several high-profile attacks in recent months. Earlier this year, Chinese state-sponsored hackers were revealed to be behind attacks on Norwegian software firm Visma and European aerospace company Airbus. Hackers released the private emails of hundred of German politicians back in December. In September, two Russian spies were caught deploying cyber tools in order to sabotage the Swiss defense lab tasked with analyzing the nerve agent used to poison former Russian Agent Sergei Skripal.

EU leaders have voiced concerns that Russia will interfere in the European Parliament elections, which is set to occur between May 23rd and May 26th. Held once every five years, this upcoming EU Parliament election will be the first since Russia’s disinformation campaign aimed at the 2016 US presidential election put other nations on high alert for similar behavior. A total of 751 seats are up for grabs. Security firm Fireeye reported earlier this year that Russian hackers had been targeting European government agencies, as well media outlets in France and Germany.

Wang and Doe reportedly used “extremely sophisticated techniques,” including specially-tailored spear-phishing emails with embedded hyperlinks. When employees of the targeted businesses clicked the hyperlinks, a file downloaded and deployed malware, which created a backdoor to the computer systems. In some cases, the defendants waited months before taking further action. Then, they allegedly encrypted the stolen files and sent them through multiple computers to servers in China.

When the Anthem attack occurred, the company was quick to detect it and to alert the FBI. That was a key factor in being able to determine who was responsible and “should serve as an example to other organizations that might find themselves in a similar situation,” said Special Agent in Charge Grant Mendenhall. The Justice Department says it will aggressively prosecute perpetrators of hacking schemes like these. However, the charges in this indictment are merely allegations, and Wang and Doe are presumed innocent until proven guilty.