Without reference to Heroku's current incompetence. As a general thing, I like the idea of a "swift, well written" email to your entire userbase saying "please

Without reference to Heroku's current incompetence. As a general thing, I like the idea of a "swift, well written" email to your entire userbase saying "please reset your password, now." That seems like a perfectly reasonably response, and request of your user-base.