In reply to Paul Davidson.

Hi Paul, while we still can't talk about the nature of the breach due to the on-going investigation by two US Federal authorities on their cases, I can answer the question about why we required so many password resets.

When we first became aware of the incident, we elected to inform our customers as quickly as possible, rather than wait for a full investigation to complete (which can take weeks), during which time our customers would be blissfully unaware.

Because we informed as quickly as possible, we couldn't yet know exactly what data was involved, or even any details of what had or hadn't happened. Therefore, we took the maximum precaution and elected to roll *all* passwords, even though in retrospect you could argue that not all of that activity was strictly necessary.

While that caused work for our customers, and of course hurt us in the press, it was the right thing to do for our customers' safety and knowledge.