The title here may be a bit misleading. From the article, it actually sounds like 500px used MD5-encryption for a subset of their users’ passwords, and this is

The title here may be a bit misleading. From the article, it actually sounds like 500px used MD5-encryption for a subset of their users’ passwords, and this is the subset that they’ve prioritized forced password resets for due to higher risk. As per tachang’s comment, MD5-hashing passwords isn’t secure, but also per their comment, this is also an opportunity for them to migrate that subset of users to the presumably more secure hashing function used for the rest of their user base.