Hackers behind holiday crime spree demand $70 million, say they locked 1 million devices