I suggest that this also be announced on the front page of the site. Even better: a small but noticeable banner which appears on all pages for the next week or so.

Update: Now I hear that the 'leak' is not fixed, hence I think the site should really be taken down until that happens. Once the site is secure again, bring it up. Not a lot of point in telling everyone to change their passwords if intruders can still view them.