Hold Security says a group named Cybervor has amassed 1.2 billion usernames and passwords — but is there more to the story than meets the eye?