An attacker snuck in by creating two new user accounts. Fidelity assures customers their investments aren’t affected.