That depends completely on the method of compromise... If the compromise was due to a weak password that was brute forced, or obtained from the end user in som

That depends completely on the method of compromise... If the compromise was due to a weak password that was brute forced, or obtained from the end user in some other way, then there is absolutely no need to reset every user's password. The only time a 'reasonable mind' would think to reset everyone's password is if the attacker exploited some flaw in the underlying system, which could have given them access to arbitrary passwords.