[justinhj]

In order to know this they must have stored and subsequently analysed the ssl traffic. Something that I would think is quite unusual. So the true scope of data theft is probably much larger.

[simcop2387]

They might have turned on that logging when the bug was announced so that they'd have an idea of the threat they were under while updating.