The password manager says customers began receiving emails on Jan. 19. Another wave of emails was sent by scammers a few days later.