I am a staff member of a large fanfic site, but not the head administrator with control over the site itself.
Recently, we had a security breach and the databases were copied, which included the users' usernames, emails, and password hashes. We put a notice on the front page telling people that we were hacked and that they should change their passwords anywhere else where they use the same password.
However, during a staff meeting, we had a chance to look at the backend structure. Turns out everything was MD5, with the same salt for every user.
I have been trying to convince the rest of the team that this is a very bad situation. I do not think they understand how easy it is for someone to break most of those passwords in a short amount of time despite everything I have done to explain the basics of salting and why MD5 is too fast to be good password security (I've been recommending bcrypt). If compromised users are using the same passwords on other sites, they are at risk of being compromised there, as well.
But most importantly, I've been imploring them to email the users, because simply posting a quick notice on the front page is not going to reach everyone. Their main counterarguments:
We have limited ability to send out that many emails from our server, so reaching everyone is not feasible. (I then recommended Mailchimp, but this was "too expensive" and that I am asking them to do "more than the big companies would do, who have more resources").
If someone's password is weak enough to be cracked that quickly, there is no point in emailing them because the attacker would have compromised them already by now.
Our main focus is patching up security going forward, not worrying about the past.
I've been trying to counter these arguments because I think they are not responsible or justified excuses, but I appear to be failing. It seems like a huge risk to have an information leak like this when security was this poor, and then not properly inform your users (directly via email) that they need to change their passwords. Putting up a notice on the main page or relying on word of mouth, to me, is not nearly enough and won't necessarily reach inactive users who still have accounts on the site (which are many, if not most).
Am I overreacting? Am I expecting too much from them? Is it unreasonable for me to expect them to email everyone? Am I overestimating the severity of the situation?
What more can I do or say in this situation?