Overall I like this approach. If this is an honest oversight and they take actions to rectify it then that is the best. If, on the other hand, they ignore i

Overall I like this approach. If this is an honest oversight and they take actions to rectify it then that is the best. If, on the other hand, they ignore it then I would let the public and everyone else know because there are a bunch of other people that are at risk. This gets worse when bank accounts are involved because the protections for businesses and consumers are next to nothing if your information is leaked out from a legal perspective and there are many instances of banks not backing up their customers. We ended up ending a consulting engagement because a client had some big holes in their account security for bank accounts and had no interest in rectifying that. Our problem with that was twofold. First, the customers our former clients had no idea that there was an issue and second, if a breach did occur it could have put our clients customers out of business. There are stories about that happening. I have personally run across way too many business that are interested in making money, even if that is at the expense of others with severe consequences for those actions.