I don't know if they've invalidated my password, or if the attacker has already accessed my account, but I can't login with my details.
I can't help but think that they would be better off just doing an UPDATE users SET password='';, and relying on the forgot-password functionality to let users get access again
edit I received my forgot-password email after 4-5 minutes waiting (their servers are under quite a bit of stress right now .. understandably)
Once I was logged in via the forgot-password link, everything was quite snappy.
Just give it a few minutes and it'll reach you too, then you can reset your password to something random. (I can't recomment 1Password[1] enough)
I can't help but think that they would be better off just doing an UPDATE users SET password='';, and relying on the forgot-password functionality to let users get access again
edit I received my forgot-password email after 4-5 minutes waiting (their servers are under quite a bit of stress right now .. understandably) Once I was logged in via the forgot-password link, everything was quite snappy. Just give it a few minutes and it'll reach you too, then you can reset your password to something random. (I can't recomment 1Password[1] enough)
[1] https://agilebits.com/onepassword