How presumptuous. I’ve worked with all of the teams involved in this specific incident over the past 12 years. I’ve helped lead incident response for much large

How presumptuous. I’ve worked with all of the teams involved in this specific incident over the past 12 years. I’ve helped lead incident response for much larger breaches. I know what’s involved. And the moment you’re aware customers have had their passwords exposed (even if hashed) you come clean on it and empower them to take mitigating action so that they’re not unduly exposed longer than they need to be. You probably even consider forcing password resets for everyone. As Heroku did, in its own hamfisted and still too slow way.