German officials confirm 18 million emails and passwords stolen