Customers left wondering what's been compromised after vendor advises resetting passwords, 2FA and passkeys