I think a lot of issues are never reported because of stuff like this. We hear about white hat hackers getting sued all the time. And in the end it'll hurt us all because crooks don't care, and will use these found-but-undisclosed security holes to their advantage. Then, when they threaten the company to either pay or get a public dump of their wide-open database, management refuses and gets a slap on their wrist by the government once it's released - and customers receive a "sorry, we got hacked"-mail between a bunch of highly personalized phishing mails.