Hackers fooled Save the Children into sending $1 million to a phony account