The only reason for "reasonable disclosure" deadlines like these is a tradeoff between 1) damage done by disclosing before patch available and 2) damage done by

The only reason for "reasonable disclosure" deadlines like these is a tradeoff between 1) damage done by disclosing before patch available and 2) damage done by evil actors finding the same bug before disclosure & patch, the assumption being that disclosure will speed up patching. On the bug difficulty totem pole, this one hangs rather low. Hell, they even claimed it was a duplicate report. I'm surprised the newspaper didn't run the story anyways, because on a data leak bug like this the work isn't done when you patched the original problem, only when you have combed through all the application logs, identified malicious requests and notified customers and authorities of possible leaks can you claim to have dealt with the issue at hand. (Yes, if your app server isn't logging all requests, you should probably start today, otherwise you end up like the NSA when Snowden took off and you first learn of lost data when it appears in a newspaper)