[educating]

> Passive attacks are however limited in the information they can reveal

Of course they are limited in the information they can reveal. They can only reveal as much information as is there to reveal. That in itself is a limit. That is a non-informational, misleading statement.

> ... and easily defeated with relatively simple cryptographic techniques.

While some cryptographic techniques are "relatively simple" to use, those same techniques can be undermined. In the current case, the attacker was involved in developing that technique and/or has the overwhelming power to make the technique worthless (acres of server farms, able to churn on any of it).

The only tecnique to guard data against passive attacks is to destroy the data, all its copies, and all who ever saw the data.