Drop in hacked records points to craftier attacks, not better security