That’s look like mistake of ICO to me. How could they be so unreasonable I would say. The only source for the security breach is via their website or the token address of wallet where they are storing their tokens. How on the earth they end up leaking that kind of information.
That’s going to be hard punch on them. Lolz. Next time they won’t leave it open.
They are completely safe for the time being, but it’s upto you how you handle them. Any misleading step, and you loose it.
The #2 post looks enough to me.