And even if it wasn't they've probably spent months unsuccessfully trying to decrypt the password, so why would it be any easier for anyone else, but yes, I doubt they're legit anyway.