Breach of nearly 2.7 billion records underlines password flaws