WP Engine Got Hacked

I've loved WP Engine so far but this leak and the lack of transparency has me concerned. Hoping WP Engine will explain the situation soon.

A word on their customer service:

WPEngine has demonstrated exceptional technical support for me over the past 3 years, but this post demonstrates a serious shortcoming. The address consists half/half of "what we did (or didn't do)" and "what you now need to do." Had they had better customer support, the ratio of the former to the latter would have been much larger.

I have 25+ installs. Waiting on support to clarify what if the "original" admin account applies to installs I have transfered from another web host. Also waiting to hear if live and staging SFTP passwords need to be changed.

Also worth noting that my WPEngine customer password was invalidated (forcing me to reset) however it appears SFTP, and WP Admin passwords were not (invalidated) as I can still access.

I have one serious site at WPEngine. I followed their instruction, but for me their information is not enough. Full disclosure please.