I think the logs were accessible to anyone in the company, probably vendors also. So disclosing seems appropriate, I dont think this kind of wide sharing of sen

I think the logs were accessible to anyone in the company, probably vendors also. So disclosing seems appropriate, I dont think this kind of wide sharing of sensitive data is the norm, I have seen this mostly at startups (but also some others) that move fast and see security as developer productivity friction. Companies that take security serious wouldn't give access to logs to everyone in the company in the first place.