Healthcare.gov users told to change passwords following Heartbleed flaw

I did some poking around when Heartbleed first was disclosed publicly, and while hc dot gov may not be directly affected, a number of the state exchanges are. Not seeing this reported, anywhere.