In Bell's defense, a chat with a tech support person is not exactly what I'd call responsible disclosure. However, I've spent the last twenty minutes on Bell's

In Bell's defense, a chat with a tech support person is not exactly what I'd call responsible disclosure. However, I've spent the last twenty minutes on Bell's website and in that time, I have not found a single way to notify them of a security breach. In my opinion, responsible companies (aka - the kinds of companies we should give our data to) assume that they are vulnerable to attack and make it easy for researchers to report possible problems. Having a disclosure policy and a simple, secure way to contact professionals on yourdomain.tld/security would prevent so many of these problems from ever happening.