contains both unencrypted data, such as website URLs,

No I think this is the worst that could have happened short of loosing the clear-text passwords. Noone is going to stop the attackers from looking for high-value login URLs and than spear-phish the password for the offline vault.

Forcing a password reset onto customers is not going to help LastPass here.