I decided not to reset password for everyone for my web service. Instead, I sent out a security alert email to everyone with links to ArsTechnica article http:

I decided not to reset password for everyone for my web service. Instead, I sent out a security alert email to everyone with links to ArsTechnica article http://arstechnica.com/security/2014/04/critical-crypto-bug-exposes-yahoo-mail-passwords-russian-roulette-style/ http://arstechnica.com/security/2014/04/critical-crypto-bug-... and Heartbleed bug http://heartbleed.com/ http://heartbleed.com/ for more information and a link to our password reset page. We also have a security alert on user dashboard that they see after logging into our system.