What irks me is that they're not going to issue a mandatory password reset, since they only do so "in cases where there’s definitely been signs of abuse." Even

What irks me is that they're not going to issue a mandatory password reset, since they only do so "in cases where there’s definitely been signs of abuse." Even if it's an internal server, having passwords stored in plain-text always merits a password reset. Storing it on a file-server unencrypted somewhere is just as bad (and arguably worse), than storing them in plaintext in the database.