If you actually look at what was ACTUALLY said:
There have been 10 million cards used on PSN. They've continued to claim that this information was not only encrypted, but stored separately from the information that was compromised. They do not believe that even the encrypted data was accessed, but if they are wrong they will cover any costs people incur in correcting the problem.
This is what they said here, not necessarily what is true. Still, it seems to me that this particular story is misrepresenting Sony's claims, at least.