They probably dump whole website database, can you force password reset? but you didn't find the hole at what i get, so even if you reset hacker will be able to compromise the accounts again?