As a parting thought, check also to see if the web site provider offers a two-step verification method to protect your account details (e.g. requiring an additional one-time passcode, send via SMS to your mobile phone, in order to modify your account settings). This will further secure your account.
While I wouldn't want to speculate on if this number is correct or not, I do agree that such is the industrialisation of cybercrime today faced by businesses, governments and consumers, that relatively small numbers of common exploits and cybercrime tools are widely used by the professional gangs operating around the world.
Despite 'snake oil' claims from many security product vendors, there are no silver bullets and security is no longer simply a question of building up the walls around your business, you need to have threat visibility across your entire enterprise and deal directly with the issue quickly and efficiently. Only by deploying a solution to execute on the entire lifecycle of the threat can you ensure you are protected before, during and after the attack.