They now confirm https://blog.hipchat.com/2017/04/24/hipchat-security-notice/