probably bitsler will force users to change password on next login, but still that's a huge leak.