> his old employer used non-protected but difficult-to-find preview links for ticketing pages.

Oh come on, I find it difficult to have sympathy for a company that does this.

It's a ticking time bomb, and certainly not hacking.