Overall I agree, but not requiring users to change password when the hashes were taken is a bit too soft IMO.

It will also be interesting to see if they make a public disclosure about the specifics of who and how. They also don’t specifically define if media watched data was included or excluded.

Either way, happy I migrated to Jellyfin.