I thought the same thing when I received it. However, at the end I gave them the benefit of the doubt that perhaps they were migrating from one hashing algorithm to another and decided to just reset everyone's password in the process. Lying about the breach entirely is so shady