Two million passwords to sites such as Facebook, Twitter, and more have been compromised by a hacker