Mark Russo reported the dataset to all the right organizations, but still couldn’t get into his accounts for months.