Most of the app's userbase seems to have been exposed, so users should be on their guard.