The exploit only works on whatever data's in memory. If someone had started attacking servers when Heartbleed started being publicized, they'd be getting passwo

The exploit only works on whatever data's in memory. If someone had started attacking servers when Heartbleed started being publicized, they'd be getting passwords and data from users who were active at that point in time. Unfortunately (perhaps interestingly) right after the announcement I would imagine that much of this activity would be changing passwords. I'd like to think that they were good about telling people not to change passwords until the hole was patched, but presumably some people would still start to change their passwords. Ironically this hurts more than helps.