Slightly pedantic: &quot;Discovery 1&quot; email indicates that the $loginkey encryption was the weak md5 method until it was changed to bcrypt in a 2012-06-14 commit.<p>As a result, any accounts that were created before 2012-06-24 <i>and</i> that did not have their password changed after that date (which would generate a new bcrypted $loginkey) were vulnerable.