There is no reason to create panic. Attack was on 19 march, was discovered and stopped in few hours. Some clients may remember that dumps where not adding to their cart (probably adding to xylibox's cart

)
Vulnerability was patched , dumps leaked from shop where removed, and a fresh update was just made today.
I was not lying, that was my support and he was unaware about the situation at that time.
So..at the end...clients still have money in their accounts, and they can buy fresh dumps from shop.
In my opinion xylibox is probably a white hat, or a "hacker-for-fun" using his blog to brag about his works, instead of being a "honest" worker like the rest of us.

As you can see on his blog vmadumps is just one of the tens of shops(he says) he hacked.
conclusion: If you're not in this game for the money, why risk ending up in jail? There are better things to do for fun: watch anime, stay on facebook...etc.