You can't help but wonder if EH.net will become a target in this new wave of attacks at some point.

Password change? I think so 

It has already been targeted by the hacktivist groups from time to time. Being a target doesn't mean it's unsafe. It's when there's a compromise of security, that you should change your password.

True. But if it is not detected, then the attacker most likely has a backdoor, meaning that changing your password is pointless since he or she can just download the database, modify the encryption scheme, or backdoor the login function for that sake, so your password is sent in clear text to the attacker, and in this case HTTPS and HTTP does not matter at all, since the passwords can just be stored in a default looking file on the server. (The last attack has been seen before.)

If the compromise isn't detected, there's no remediation of the risk, caused by an "agent" and a vulnerability in other words.

EH-Net has been targeted in the past. Passwords have been compromised and posted online.