All customer passwords were encrypted with BCrypt.
The correct term is "hashed", not "encrypted". Huge difference.

i sure hope Zhou knows the difference

Well, he mentioned BCrypt, which is a hashing function, not an encryption function. I think he just inadvertently used the wrong term here.