Looks like the Eradication and Recovery steps in incident management are not going well for HeartBleed issue.

Being Lazy or Not Smart - You will still continue to (Heart)Bleed and make others vulnerable

Sometimes other people's stupidity and laziness affects us. Internet is a good example.

According to Netcraft's survey 

• 43 percent of sites have reissued their certificates since the appearance of Heartbleed. 
• Seven percent of those have reissued them with the same private key. 
• Only 14 percent have revoked and reissued with new keys, which is the full set of tasks necessary to prevent attack.
• Overall, 20 percent have revoked their old certificate, a few without reissuing. Finally, five percent have revoked and reissued, but used the same keys as the earlier certificate.

The link below has more information:-

http://www.zdnet.com/many-sites-reusing-heartbleed-compromised-private-keys-7000029282/