They admitted that the encrypted CC numbers were leaked, they didn't mention if the encryption keys were stored on the same machine. The alleged hacker said that the encryption keys were stored on the same machine, making the encryption useless.
Linode confirmed that the private encryption key was stored on the same machine. They've been parroting lines about the password on the private key being too strong to crack.