Nothing. The breach is over. And they should force user password changes. I'll say it again. I'm simply disagreeing with the phrasing of the title painting this as protecting users.