Reading this article on BBC News dated 29th March 2018, the company in question suffered a data breach and up to 150 million accounts usernames, email addresses and passwords were potentially stolen.
The company states:
passwords were protected by strong [BCrypt] encryption
And an independant voice [Troy Hunt] was quoted as saying:
To its credit, ... [the companys] method of password storage is quite robust.
The company states also that:
The company will be requiring users to change their passwords and is urging users to do so immediately.
However; if a company uses "robust" password security and password hashes; is there a security need to then change these hashes?
I realise that the call to change passwords is mostly a PR exercise and that some folks would then query/negative PR if the company didn't encourage it's users to change their passwords following a breach;
but purely from the technical security point of view I can't see that there is any need to change password as long as the encryption method is fairly strong and resilient against bruteforce attempts -- which BCRYPT seems to be.