Ask PG: What steps would you advise a company to take after leaking passwords?

If one of the YC companies leaked half of their user's hashed passwords and immediately asked you for your advice on what to do, what would it be? What if they had low security standards? Would it change if the company was bigger? (even public?)