So I went to check it again just now after reading your comment, and I was immediately as soon as I opened the app, prompted to create a new password, which I did.
very very sketchy things going on here. But I'm glad that they didn't fully allow my account to be stolen :/