Don't presume that people already know the story. Here are a few links, to start with: http://www.wired.com/opinion/2012/11/att-ipad-hacker-when-embarassment-

Don't presume that people already know the story. Here are a few links, to start with: http://www.wired.com/opinion/2012/11/att-ipad-hacker-when-embarassment-becomes-a-crime http://www.wired.com/opinion/2012/11/att-ipad-hacker-when-em... http://techcrunch.com/2013/01/21/ipad-hack-statement-of-responsibility/ http://techcrunch.com/2013/01/21/ipad-hack-statement-of-resp... http://cfaadefensefund.com/ http://cfaadefensefund.com/ I recall at the time this story originally hit (or soon after) some concern/speculation as to whether he originally intended to report the problem or whether he did so after thinking through the cost/benefits of using the data privately versus reporting the problem publicly. I do not know whether this is the case; perhaps someone else can speak to this more authoritatively. Regardless, he reported the problem. Also, I think many non-technical actors and reporters in this have no concept of how quickly and effectively a very simple script could scrape that number of... I don't even want to call them "accounts", because they were public pages and set up in the vast majority of cases without the data owners' knowledge. Once you have the proof of concept script, 10 examples versus 100,000 examples may be just the difference between a second or two's run and several (well, maybe many) minutes' run. Hell, the phone could ring, and you hang up a half-hour later to find/remember that your script is still running. I'm not saying that's what happened; on the other hand, it easily could have. P.S. Regarding that defense fund link, whoever's managing it should try a little SEO; currently, it's not in the top two pages of Google results against Andrew's full name. (I got frustrated and didn't look further into the results.)