He did not disclose the company name (but easy to guess if you work on IT in Spain), so I don’t think he could have legal issues because of the post.

But, the cyber security professionals working in the consultancy firm can gather easily the small pieces of information left behind and sue him if they find out data extraction, for example.

Keep in mind that he claims he extracted sensitive data, but he could be lying just to be in the HN front page. Who knows.

Unethical, risky… and very stupid.