According to Disney's breach notification, the crooks "acquired passwords," which means they were stored in plaintext. Here's what to do.