The company plans to alert 1 million Facebook users that their account credentials may have been compromised by malicious software.