Not sure how useful that reset was. All I had to do was type in my old password and then choose a new one. No email verification, no reset token, nothing. So if the password was indeed compromised, couldn't the attacker do the same?

Yes, he could. But he didn't. If he did that, the page would tell you that your password is wrong, and you'd contact support. The attacker probably didn't change any password, because it would be futile.

Also, the attaker could also change the account email. Neither tokens nor email confirmation would help.

The biggest problem is for people that used the same password on Linode and any other important service. (And, of course, all the CC stuff...)

It addresses the "attacker has a list of hashes that'll take him a while to compute matches for" aspect of things.

Not only that, it also makes me wonder about the free RAM upgrade from almost a week ago. Some people are reporting their Linode credit cards being used for fraudulent purchases as far as a week ago, so this might have been a move to gain some pre-emptive goodwill.

I don't know though... will wait until more details are available but will be keeping an eye on CC statements / VPS alternatives.

"Someone hacked us and stole customer details... quick, give everyone more RAM!"

Doesn't sound very plausible to me.

Logically, they couldn't have planned it all in such a short period of time. However if they did, from a business perspective it is very good plan. Without the upgrade, today some customers would have had two reasons to leave Linode, now they only have one.

I tend to think the timing is just a coincidence. They also upgraded CPU and bandwidth over the last month and there were rumors of upgraded RAM for a while too.

I believe that to be a coincidence. They have been performing upgrades for a while now. (Increased hard drive space, increased CPU, and finally increased ram.)

I think it was just an unfortunately timed third phase of their upgrade plan.