How long before a hacker tries a leaked user account?