Update: Heroku to begin user password reset almost a month after GitHub OAuth token theft

"The initial detection related to this campaign occurred on April 12 when GitHub Security identified unauthorised access to our npm production infrastructure using a compromised AWS API key," GitHub said.