The threat was a hoax so in a sense nobody was actually affected. The person making the threat never had access to passwords in the first place, just a bluff that luckily nobody fell for.