I'm pretty sure they're required to disclose that, and since they're already publicly admitting to some breaches, I doubt they'd be trying to hide parts of it while they're already likely being looked into.

It sounds like the data that was gathered is the sort of data that a customer support rep should have access to. They typically can only see pertinent details like what is necessary to verify a customer's identity and their device details, which lines up with what was mentioned in the disclosure. I imagine some CSR probably got their work account phished or something.

Passwords are probably just fine, from the looks of things.