passwords were leaked, but were per-user salted & 12-round bcrypted, so there has not been a mass password breach. with significant computing power and weak enough passwords, obviously some passwords that are extensively targeted (say, a famous or infamous creator) will be compromised in the coming weeks & months. which, of course, is why the initial announcement suggested all users change their passwords as a precaution.