Why take 2 weeks before telling people to change passwords?! Tell people there's been a possible intrusion, recommend a password change while investigating!