compromised passwords

A customer just received an eMail from Google with the above subject line - and wanted to know if it was legit (and if they needed to do anything). The eMail from Google is legit; but the answer to the…