Wow, so many things.

1. No indication that anything was done beyond tracking browsing, but the capability for tracking keystrokes etc. appears to be in the code.

Just to cover my bases, I'm about to change all my passwords. Have been meaning to put together a personal data breach bug-out manual anyway.