The full article is at IT Pro:
An attack on Apache’s project server has resulted in passwords being stolen from all users.
By Jennifer Scott, 14 Apr 2010 at 11:25 

And continues:
“If you are a user of the Apache hosted JIRA, Bugzilla, or Confluence, a hashed copy of your password has been compromised,” said a blog post from the Apache Infrastructure team.

It has warned users of any of these programs to change their passwords, especially if they logged in between 6-9 April.

It has also left those who had Atlassian accounts before July 2008 in danger as an old unencrypted database containing customer passwords was left online and could have been compromised.

“We made a big error,” admitted Mike Cannon-Brookes, chief executive of Atlassian, in a blog post. “For this we are, of course, extremely sorry.”

He added: “The legacy customer database, with passwords stored in plain text, was a liability. Even though it wasn’t active, it should have been deleted. There’s no logical explanation for why it wasn’t, other than as we moved off one project, and on to the next one, we dropped the ball and screwed up.”

Apache is running JIRA on a proxy configuration for the meantime and has made a number of changes to make the server safer.

“We hope our disclosure has been as open as possible and true to the ASF spirit,” concluded the Apache blog. “Hopefully others can learn from our mistakes.”