Many moons ago we were scanning ourselves to test changes to our infrastructure, and when testing externally scanned /24 instead of the /29 range we had. We fou

Many moons ago we were scanning ourselves to test changes to our infrastructure, and when testing externally scanned /24 instead of the /29 range we had. We found two wide open SQL servers, listening in public addresses with blank sa passwords (the default on install at the time, oh those innocent days...). Out of curiosity we had a quick look and found one if them contained credit card details. We backed out very quickly... Not wanting to leave such a hole open but also not wanting to risk accusations of hacking we worked out who the companies were by other clues and forged emails warning then about the issue (sending them via a wide open SMTP server, again innocent times!). We never checked to see if anything changed.