I believe they are trying to make sure the system is secure first. No point in having everyone reset their password if the bad guys still have access to the password db.