Salesforce informed you that their entire DB was compromised, and not just the Github OAuth tokens, as they've been saying for weeks? The first indication that

Salesforce informed you that their entire DB was compromised, and not just the Github OAuth tokens, as they've been saying for weeks? The first indication that anything except a Github specific DB was compromised was Tuesday, when they started telling people that seemingly-all non-DB non-addon credentials were going to roll.