Even though the sensitive information was hidden in the HTML and not visible in plain view, the Google crawler observed it and recorded the information to put into its search index.
FORBES: Blippy Apologizes For Google-Searchable Credit Cards, Announces New Security Plan