A recent study of 800 million breached passwords found that 88% of passwords used in successful cyberattacks were 12 characters or less.