I imagine you can triage that quite heavily; change the critical ones (bank/email/etc.), then change anything where passwords and usernames have been duplicated

I imagine you can triage that quite heavily; change the critical ones (bank/email/etc.), then change anything where passwords and usernames have been duplicated. Anything else is probably pretty low priorty both in importance or criticality.