HeartBleed is a way to get a chunk of the server's memory. Regardless of whether or not someone is actively looking at sensitive data, there is at least one piece of sensitive data that will be resident in the server's memory - the server's private key for the ssl certificate. We know that is actively in use because the attacker's own connection would have needed to be established with that key.
If no-one else has used the server, that may be the extent of it, but that key is sufficient to allow the opportunity for attackers to perform man-in-the-middle attacks and/or otherwise impersonate the server.
If the server is in active use and is sending back sensitive information, the contents of those requests/responses (which may include user/passwords) may (or may not) be found in the returned chunk of memory. Other possibilities for an active server include session keys and potentially sensitive usage data.
All in all, it is a bad one - make sure you're patched.