Turns out the master database with encrypted username/passwords got leaked and encrypted environment variables were also leaked but it was like pulling teeth to get them to answer whether or not these happened or even admit that it might have been possible. Presumably more than this was also leaked but so far they haven't said anything on that. Env vars were the biggest concern on everyone's mind.
They gave the absolute least amount of information over the longest period they could muster.
The problem wasn't the hack really, it was the lack of transparency in the response.
See: https://twitter.com/jacobian/status/1522782890957819906
WTF!!!!
That alone is disastrous enough, they should be reprimanded for this. Are there I'm sure, class action lawsuits happening?
How much of an impact will this have on Salesforce? I mean imagine the data from that alone would be immensely valuable.
If it comes out that the hacker did get to unencrypted env vars I think it's game over for Heroku. Nobody should trust them with sensitive data.
When they started sending out password reset emails, they should have explained why.
Not only when people started complaining, and the media picked up on the lack of transparency.