[bibinou]

the subsequent blog post (https://blog.heroku.com/we-heard-your-feedback) says:

> Additionally, we have no evidence that the attacker has accessed any customer accounts or decrypted customers’ environment variables.

which, as pointed out in its HN thread, means "we now know they got access to encrypted vars, and we don't know yet if they could have decrypted them." in BS-speak.

The title "We've Heard Your Feedback" is also a red herring, usually means "we know we fucked up bad and we still have no idea of the whole impact of the breach".