Keep in mind he was referring to credit card information, not the credit card number. He mentions this here: "We do not have evidence that encrypted credit card numbers or personally identifying information were taken by the intruders, or that the protection on credit card numbers or passwords was cracked." By credit card information, he's referring to address and name, for example, which, at last check (earlier this year) didn't necessarily require encryption.
That the information had encryption is a good sign.
That the information had encryption is a good sign.