I really don't think it's that big of a deal unless you are a public figure or a person of interest. I didn't change my passwords after the Google breach for 3 years untill someone changed the contact email on my online account for my local bank. I just assume everything on my phone is public...