Things to think about/ask if you used the service
Have you used the password you used for babypips anywhere else? If so change it now, regardless of if you have already changed your babypips password, usual stuff here never reuse passwords across different accounts regardless of how little you card about an account.
Babypips have not advised when the breach occurred, only when they noticed it, this means if you have reused passwords previously attackers could have access to other accounts that you use, changing you babypips password means little here.
They have provided little information about
1. when it happened
2. how it happened
3. has the attacker got the salt?
4. This is the worst part
As far as our logs show, the interface was never used. We can only assume that the attackers had future motives in mind,"
One they are relying on logs, rather that system analysis/forensics, it doesn't even sound like they have rebuilt
Two. Assumption is the mother of all Blah