Given the extent of the breach, it's prudent at this point to assume all passwords have been compromised.