Unfortunately, most hosting companies don't go public and warn their users. They try to hide and hope nobody else finds out.
Glad to see them going public, warning their users and doing the right thing.
Let me ask you something - what do you see as the benefit to going public vs. not "doing the right thing". I mean that by airing dirty laundry you also run the risk of losing customers. Are you sure that the goodwill earned by doing this outweighs the downside of airing your dirty laundry? [1]
[1] I am remembering a time long ago when a business owner told me about something personal that an employee told them. The business owner said "that was stupid that they told me that, so I fired them". This idea that all people in the world view things as generously as you might most likely hasn't been proven out in research (I am guessing..)
Whereas if I never hear about stuff (or worse, I discover stuff way after the fact) then I don't have much of a basis for knowing if there is any system at all.
For instance, I don't mind getting a spam email or two when I open my email box in the morning, because then I am sure that it's working :D
I don't know how sound or rational that feeling is, but I understand it.
To this date, the breaches were not disclosed publicly.
Edit: just saying, I think it's strange that I'm finding out about it via HN first.
TalkTalk (UK ISP) got public backlash for using the media to announce their compromise via the media before notifying customers by email. The CEO said, the media was the quickest way as sending that many emails would take days.
Your customer portal password (used to access all your intals/billing etc.) will also need to be reset.
"Our investigation is still actively in progress. We share your frustration that we cannot provide answers to many of your questions. However, because this is an active, on-going investigation, including federal law enforcement, we are limited in what we can share at this time."
"We are still in the process of invalidating the passwords in phases. This process will be running throughout the day, and your passwords will be invalidated."
