Very likely some attachments will be lost as the backup for them run ~24 hours ago, i'm recovering these currently.
Atm it looks like no passwords were stolen, just two accounts were reset:
I can only advice to change passwords at mantis and to not use the same password for multiple things!
sidenote: some pending changes to the front-page / media were applied