A cybercriminal stole 1 million Facebook account credentials over 4 months