How would it have been hard?<p>Seems like a 10 minute fix at most to me to rehash the old password once the user was authenticated then put a flag whether they&#x27;ve been &#x27;fixed&#x27; or not. After 3 months deactivate the old passwords and sent them an email reset.<p>Although AM was in the business of essentially blackmailing their customers. So ease of getting back in was of higher priority apparently.