Millions of people whose personal data flowed through a single compromised Salesforce account now face a direct identity-theft risk, and most of them have done nothing to lock down their credit files.