There's a bit more info in this one about exactly what was compromised though. While I can understand the abundance of caution in resetting passwords despite only hashes and salts being lost, it is odd that they would "[presume] the attackers may be able to decrypt the passwords," assuming they're using strong encryption.
I wouldn't call resetting passwords an "abundance of caution" in this case. It's very likely that the attackers are able to retrieve passwords when they have the SHA1 hash and the salt (not exactly by decrypting though).
Do they say somewhere that they're only using sha1 though? That's sort of what I meant: if bcrypt or scrypt is used, with an appropriate work factor, the risk should be very minimal. The fact that they're assuming it's not suggests they are using weaker encryption.
Ahh thanks. I read the email they sent out, which had very similar content, but omitted that bit. Just skimmed the post itself, but obviously missed that key info.
Interesting that they don't include strengthening their encryption (ok, hashing) in the list of steps they plan to take, but presumably they will.
My god, I swear they're ninja editing the thing on me! I'm really not normally someone to comment before RTFA. Thanks for patiently leading me through it. :P
Here's a good blog post how and why this is problematic: https://www.troyhunt.com/our-password-hashing-has-no-clothes...