This is really REALLY BAD.

What other data did the attackers get other than the email?