A US security firm says Russian hackers have stolen 1.2 billion usernames and passwords in a series of internet heists affecting 420,000 websites.