hopefully their hashed/salted passwords, right? not plaintext?

Internally, sure. But the application that was (probably) compromised was an FTP client, so it would have received the plain text of those passwords from users as they logged in.

▲

trollbridge 4 hours ago | parent [-]

For those customers who are still logging in with FTP…

As a precaution they reset everyone’s email passwords, presumably from an assumption people use the same ones for both.

I’m surprise they still let people use FTP.

	▲	jacquesm 3 hours ago \| parent [-]
		I came across such a thing recently. The counterparty was a bank, and they point blank refused to update their processes so the people I talked to had no choice but to continue to use something they knew was hopelessly outdated. SFTP was released what, 3 decades ago or so? There is a good chance that whatever was on the other side of that upload was not capable of any kind of secure connection.