Here is one thing that caught my eye:
"While the passwords were not stored in plain text, good practice dictates that users should assume the passwords have been accessed and change them," she said. "If users used the same password on other services they should immediately change that password."
It's been said the password are encrypted using a HASH method. If they didn't SALT the HASH then yes you would need to change the password on other websites that you use the same password.
Had they SALT'd the passwords then it's not big of a deal. I know how it works with SALT. It's just a random info that gets mixed in with HASH making it impossible to reverse it.
Pretty stupid if they didn't do this.