> Saying that passwords are “encrypted” over and over again doesn’t make it so. They’re bcrypt hashes so good job there, but the fact they’re suggesting everyone changes their password illustrates that even good hashing has its risks.<p>This is correct, but I am going out on a limb and guessing that legal counsel had something to do with the wording here (which is perplexing because I tend to expect legal definitions of terms to be more specific).<p>I was at an organization that also had a data breach, and legal counsel advised us to write a similar email when disclosing publicly that the breach occurred. I was personally on multiple phone calls with legal counsel about this, and it was quite frustrating to try and explain the difference between encryption and hashing, or stay on point with the fact that our passwords were <i>not</i> encrypted, trying to get people to stop using that word on phone calls. Early on, they'd ask questions like, "But aren't your passwords encrypted?!" And you'd have to explain, no, they're not, they're hashed, which is most likely <i>better</i> than encrypted (although I'm open to being proven wrong on that).<p>They were, also, mostly useless on explaining what their perspective of encryption was. I never got an explanation from counsel, and at best, I was linked to a blog post that suggested some security <i>best practices</i> (not a legal definition of anything we were liable for).<p>The sad thing is, with a data breach like that, you probably do (and should) feel terrible for your customers, anyone who trusted you with their emails, passwords, etc. But the laws surrounding it are confusing enough to make it easy for some people to push this out of their mind and just focus on, "What is the best thing we can do to legally cover our asses?" Even if that means saying factually incorrect or misleading things like, "Your passwords were encrypted."