I never claimed page 346 was breaking the law. I claimed after you discover that the action reveals private data, and you repeat that action a bunch of times f

I never claimed page 346 was breaking the law. I claimed after you discover that the action reveals private data, and you repeat that action a bunch of times for the explicit purpose of getting more private data, you are now a criminal. This is what the OP very clearly stated he did. He did not report the issue after finding it. He abused the security hole for his own benefit. He is a criminal. Low severity? In civil court, they can take every penny he has, every penny he'll ever earn, and his house. In criminal court, he can be charged with unauthorized access to a computer system, one charge each time he did it. And he did it a lot, and they have logs. Which is all literally in his post. Viewing other people's medical information is not a low severity crime btw.