Unless I missed it they have left out the critical information about the timing of when the password database backup was taken. This makes enormous difference ... it could be that the attackers have had months to brute force this already if it occurred shortly after the August incident vs if it happened yesterday it is very unlikely they have brute forced many accounts.

If they don't know they should say they don't know, if they do know they should absolutely be telling people this!