How one of the biggest data thefts in US history could have been stopped by basic security