Cybercriminals armed with usernames and passwords broke into customer accounts at American and United airlines, with some going so far as to book free flights and seat upgrades.