I wouldn&#x27;t call resetting passwords an &quot;abundance of caution&quot; in this case. It&#x27;s very likely that the attackers are able to retrieve passwords when they have the SHA1 hash and the salt (not exactly by decrypting though).<p>Here&#x27;s a good blog post how and why this is problematic:
<a href="https:&#x2F;&#x2F;www.troyhunt.com&#x2F;our-password-hashing-has-no-clothes&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.troyhunt.com&#x2F;our-password-hashing-has-no-clothes...</a>