Sensitive data shows

That message is an OEM-defined one, and therefore the contents are "outside of the specification" - so you can do whatever makes sense. I would personally just say "the password for account XYZ was changed" since those redacted values, in my opinion, don't provide any value.

In our standard Message Registries, we avoid creating parameters that would contain sensitive data to avoid any confusion or coding errors that could accidentally reveal that data...

Jeff