I already changed my credentials as soon as Ars posted the hack, but I feel folks are still at risk for ID theft even if you change passwords (because of the names, addresses, phone numbers and other stuff except financial).