Yes they said that in the first paragraph of the incident report you posted a link to ;)<p><i>Unfortunately, the passwords were hashed with the SHA1 hashing algorithm, which by today’s standards is considered weak</i><p>Also, hashing != encryption