Maybe? I don't know. It's important to act reasonably and not to spook them into releasing all the data. My company could probably do with an extra pair of hands, especially someone who's proven they know their way around debian / SQL (probable attack vectors), and now they have the DB schema to study, so... not the worst candidate... Plus, the company would by now be busy with the task of patching all the exploits.

You almost have to look at it from their point of view. Their options are (a) sign NDA, take employment, money, an honourable way out of a difficult situation, or (b) go on the offensive, release the data for little or no personal gain, and suffer through a police investigation and potentially jail-time or a permanent criminal record. Option (A) works out better for your company, your product, and for them, so you might as well aim for that.

I think this is a pretty common approach. Although, it's been used in stings in the past, where a fake offer of employment is enough to get the person in the flesh where the police can take over. There's one very interesting story from Valve about the leak of the Half-Life 2 beta[1] - and of course, Owen Walker[2] found employment after a high-profile hacking case.

It would be interesting to see what other companies in similar situations ended up considering...

__________________________

1. http://www.theregister.co.uk/2008/11/14/half_life_sting/

2. https://secure.wikimedia.org/wikipedia/en/wiki/Owen_Thor_Wal...