My concern is that if the password was poorly chosen, the private key won't be very safe if they got the private keyfiles. That many credit card numbers is a hu

My concern is that if the password was poorly chosen, the private key won't be very safe if they got the private keyfiles. That many credit card numbers is a huge target so it'd be worth an attacker expending some money on. If it's a strong, long non-dictionary passphrase, then I'm not nervous. But, we don't really have any idea if it is or not. The fact that their web interface boxes had the private key on them is a huge concern - you'd ideally run all billing stuff on a machine that is highly locked down, perhaps not even accessible outside of a very strict range of IP addresses. The practice of leaving the private keys hanging around on the same boxes that ran the website makes me awfully nervous about the other links in the chain.