Slack was broadcasting hashed passwords for 5 years (honeypot.net)

"The bug we discovered was in this invite link event: along with the information about the shared invite link, we included the hashed password of the user who created or revoked the link. This information was sent over the websocket to all users of the workspace who were currently connected to Slack."

Slack has posted about this on their blog now: https://slack.com/blog/news/notice-about-slack-password-rese...