For 19 years, the Verizon Data Breach Investigations Report (DBIR) told a consistent story about how attackers get in: they use somebody’s password.