Even if you didn't use Tor, your ISP or proxy server could also steal your password.
You'll have to use your own judgement on that. Do you trust that your VPN/ISP didn't use this attack against you to steal your password?
Some things to know:
- It's an active attack, so if your ISP was just recording traffic, this wouldn't help them now.
- If you didn't actually use your password to log in within the last couple of days (ie, not just logging in using "remember me"), then your ISP only could have stolen your password if they'd known about the vulnerability before it was publicly announced.