i cannot imagine that a remembered passphrase would take too long to brute-force on a few multi-GPU setups. unless they did something meaningful like making it a long sentence rather than some short-but-complex-for-humans 15 char string. http://xkcd.com/936/

  07:52 < HTP> the CCrypter class of the linode application 
  context was accessable from outside the wwwroot using 
  undocumented ColdFusion methods. i was fully able to 
  decrypt the ccs using the in-memory privkey that they 
  supplied the password for.

From the 2nd pastebin'd IRC log, http://pastebin.com/7WXRDyAg

Note that he states all information was deleted. They had claimed earlier that CC info would be released on May 1st.

note: temp account because I accidentally set noprocrast delay to 1 week. Whoops!