These crooks have stolen millions of passwords. Here’s how to avoid becoming their next victim