"credit cards were encrypted, sadly both the private and public keys were stored on the webserver so that provides 0 additional security"

That's just poor security and 100% they're own fault. I accept that there are security issues with every platform, but basic security measures and being transparent is still expected. My biggest issue with them in all of this is not being transparent.