They say everything should be encrypted but are urging users to change passwords just to be safe. Their servers may be overloaded with people trying to do so because I couldn't load the reset page.