Yes - definitely. I was just saying passwords because they're something that could have leaked which could be used to actively compromise accounts and result i

Yes - definitely. I was just saying passwords because they're something that could have leaked which could be used to actively compromise accounts and result in further attacks now. And probably the only thing most sites can do anything about at this point. Of course if you were sending private keys, api keys, etc over an SSL connection - those all now need to be treated as exposed. Some sites may also have special concerns - btc-e for example, a fairly large bitcoin exchange allows users to withdraw to a "btc-e code" which can be deposited by another user of the site. It'd be a serious mess if any of that kind of thing leaked.