The key thing here which Air NZ have not mentioned (and I can understand why they haven't because they hadn't had a password leak) is to ensure that if you're somebody who uses the same password across multiple websites that you immediately change your Airpoints password.
While Air NZ hasn't had passwords compromised, email addresses have been compromised, and if your email address and password has been compromised in any of the other large scale security lapses then your Airpoints account is at risk. If the Airpoints password you use is in the haveibeenpwned database you should immediately change it.
But I'm sure nobody on here is stupid enough to have such poor security that they reuse passwords across sites..
