The compromise was with the application and they had no access at any time to the database. However, for a second let's say that they did. Your password is saved as an md5 hash with a salt added to it. We don't actually ever save your password. When you type in your password, your specific salt is added to it and it's hashed. The resulting hash is compared to the hash stored in the database. If they match, then it lets you in.

MD5 is a one way hash. This means that you can't take a hash and figure out what the original string was. While there are md5 lookup databases that try to catalog all possible hashes, the fact that we salt the password first makes them completely unusable.

This is why if you forget your password here that you can only get instructions to reset it. We can't ever send you your password because we don't know what it is. If a website will email you your password when you forget it, that means that they store your password directly. That's a bad thing.

We didn't warn anyone that they should change their passwords because there is absolutely no way that someone stole your passwords.

Thanks!