I don't think he had to, but he got an answer in minutes. I don't think that's the part to be worried about.

As for what you should do: it sounds like the impact is relatively low. I'd personally change easily-changed secrets which go over the session, and potentially externally facing customer passwords (yes in enterprise, maybe not in consumer).

(I don't have any insider info on this breach, though, but I read both posts and know how the system works.)