GoTo claims that cybercriminals stole encrypted backups and MFA settings.