Gang has billion credentials: “keeping personal information out of the hands of thieves is … a losing battle”