Hm, I think I misread the article. It just says it was accessing a database named after the client, not that the user/password suggested being specific to the c

Hm, I think I misread the article. It just says it was accessing a database named after the client, not that the user/password suggested being specific to the client. So you're right, it being hard coded then suggests it can likely access all of them. He should have stopped there and reported the issue. While paying a fine of 3000€ is likely without consequence for most programmers, that's not the only thing that happens. It now shows up on his criminal record and would be considered in any future case against him.