If I recall correctly there was a large company several years ago who tried to prosecute a whitehat who discovered their user account pages included the users'

If I recall correctly there was a large company several years ago who tried to prosecute a whitehat who discovered their user account pages included the users' e-mail addresses and that changing the address to that of a different user would drop you right into that user's page with all their personal information listed.