My cleartext passwords could have been dumped into the responses of some other site together with my user names. That's the gist of this incident.
I still don't understand why you have to change every password (are not they supposed to be all different in a password manager?). Of course if you are super extra mega careful then change them all...
pmontra doesn't have to change every password, just every password used by a website using Cloudflare (thus the purpose of the list of affected sites).