Not sure if it helps, but the UK NCSC has a general government webapp vulnerability reporting form on HackerOne (https://www.ncsc.gov.uk/information/vulnerabili

Not sure if it helps, but the UK NCSC has a general government webapp vulnerability reporting form on HackerOne (https://www.ncsc.gov.uk/information/vulnerability-reporting https://www.ncsc.gov.uk/information/vulnerability-reporting). It sounds like Apperta might have been "established" in collaboration with Government, although it's not clear if they are still run as such. In this case, it sounds like a bunch of incompetents who don't understand how the internet, or indeed security, works, who then retained a bunch of lawyers that don't know how the internet or security works either. Lawyers have an ethical duty to act within their own competency, and that can be enforced by their regulator. I'll leave it for the reader to decide if these lawyers are acting within their own competency or not. The main regulation at hand would be the Computer Misuse Act. Since they published this content onto GitHub, and the author (presumably) has evidence and an admission of this fact, they now have Github's TOS to rely on: > Any User-Generated Content you post publicly, including issues, comments, and contributions to other Users' repositories, may be viewed by others. By setting your repositories to be viewed publicly, you agree to allow others to view and "fork" your repositories (this means that others may make their own copies of Content from your repositories in repositories they control). They knowingly made it public. That means you did not exceed authorised access in anything you did, and therefore did not gain unauthorised access to any protected computer system. At least based on the info from this blog post. The Investigatory Powers Act doesn't seem relevant, at least without any detail of their claim - that's primarily to regulate government access to information, and certainly not your access to public information they chose freely to publish. An ICO report seems reasonable, though perhaps worth waiting 72 hours, so they have gone over the legally required time for reporting a data breach upon becoming aware. What's the bets their lawyers advised them to report the breach properly and promptly?