Cybercriminals are exploiting real breaches with fake notices. Here’s how to tell what’s real—and how to protect yourself.