My biggest issue is that they didn't release their data-set. With something this major, it's standard to either have a third party investigate or publicly release your data so it can be validated.
For all we know they cherry picked the responses they tested from a single site that doesn't handle anything sensitive.
For all we know they cherry picked the responses they tested from a single site that doesn't handle anything sensitive.