Risk Management.  

You've done your due diligence:  unique email/pass, 2FA, VPN. 

No such thing is "safe".

There are only 2 types of companies: those that have been hacked, and those that will be hacked.