Yeah. And if it's not all passwords under the account, the email should've had a list of the affected ones. Instead Dreamhost says both that they've already deleted the at risk passwords, and also that customers need to reset all passwords. Maybe when they mean "reset all" they meant "reset all [the deleted] passwords", but being so unclear about scope and remediation steps is a painful mistake.
A single sentence like, "If a password wasn't reset as of (timestamp), we don't believe it could have been at risk." would go a long way to fixing these incident comms, if that's the case.
A single sentence like, "If a password wasn't reset as of (timestamp), we don't believe it could have been at risk." would go a long way to fixing these incident comms, if that's the case.