An associate of mine has contacted CRU direct and they have confirmed the story. It seems clear then that the story is true. I suppose there remains a possibility that what is doing the rounds of the internet is not all genuine, but this seems fairly unlikely.

Climate Audit has been swamped by traffic, but has apparently reported that CRU has cancelled all existing passwords.

The BBC are going to try to sweep it under the carpet.