Legally, they're now required by law to disclose to their users of a security breach: http://en.wikipedia.org/wiki/Security_breach_notification_laws http://en.w

Legally, they're now required by law to disclose to their users of a security breach: http://en.wikipedia.org/wiki/Security_breach_notification_laws http://en.wikipedia.org/wiki/Security_breach_notification_la... Since whomever discovered the bug was able to access others' sensitive information, they have to disclose.