The company needs to understand the situation in order to issue a fix for the exploited vulnerability, and only then have the users change the account password.