13% of employees say they’ve sold or know someone who has sold company login details – often under the belief it’s harmless