I actually believe that is what they are doing, from some of what has been said. :/

Not that they really have much option for doing otherwise -- the passwords were in the wild for a while.