Given the breaches we've seen lately, and after going through a few sites on https://lastpass.com/heartbleed/ I'd be wary of believing what they tell you. How can you verify the person you communicated with was indeed educated enough, and had accurate knowledge of the infrastructure to make that statement?