kpumuk

Thank you for your suggestion. Not a weakness anymore :)

We have reset passwords for all affected users. Hashes that got leaked are not useful now.

Compromised != Hacked. To clarify: no accounts were accessed by the hackers, but small amount of account records have had passwords encrypted with outdated algorithm (basically SHA1 + salt), so we preemptively reset their passwords and sent out emails to all affected users.

This is how we define "compromised" - people which had their passwords hash with old algorithm, which is relatively easy to crack.

We use scrypt for passwords hashing. This is modern hard to crack password hashing algorithm.

We do have database access logs, so it was pretty straightforward to identify which users were affected.

Definitely put spaces