From Attack to Defense: Building Systems Secure against Breached Credentials