A single exposed database held 24 billion stolen credentials — how the infostealer economy industrialized account takeover, and how to defend.