Fascinating, and a little scary for a follow-up. The Heartbleed bug was used to steal ~4.5 million medical records (it.slashdot.org) from healthcare provider Community Health Services.

As the article comments point out, their intrusion started only a month or two after the Hearthbleed month was publicly announced, well within what I've experienced what a large company's patch turnaround might be. What's interesting, also, is that the affected device was a router (a specialized computer which sits at the edge of a large network and merely routes traffic according to defined rules), not a server on which the data would have resided.

And this is why I patched my shit within 24 hours. Though, I'm pretty sure I still have a few unpatched non-essential machines sitting at home. Behind an age'd WRT54G. (sigh)