Since 2018, five million people globally had data stolen. A study found that 26.6 million usernames and passwords were obtained by cybercriminals.