Exposed credentials are giving attackers a head start many organizations don’t see