How did cybercriminals manage to steal money from 20,000 accounts?