[edaemon]

Why would the attacker having your Mercury TOTP mean they most likely have access to your email?

[dexterdog]

Because my TOTPs are all stored in the same device and in my imaginary scenario they have that.