If you actually want change and things to be secured, this post might cause that. I dont understand the energy you are putting into convincing us thats a bad thing.
Companies respond in different ways to disclosures, by independent researchers and by people under contract. You are absolutely right that in many cases the findings end up in a drawer. This is a real pity. Invariably those will sooner or later be exploited by the bad guys and then the company has a serious problem: they will have to show their homework and if it is found that - at least in Europe - they were aware of the issue but did not take action it may well have the effect of changing a warning into a fine and a fine into a larger one.
yeah, good question - agreed that probably a lot safer to do this with explicit permission, though like others mentioned the tradeoff is that the company can cover it all up before it's clear just how bad the problem ever was and then say "we fixed a minor issue". I wouldn't risk my neck over that, but some people might I guess.
> To me - and please correct me if I'm wrong - that reads like 'we downloaded at least parts of 10560 tables'.
To me it sounds like they downloaded one or two records each from 10,560 tables and confirmed that those records contained emails. But you're right, I'm not sure it's very clear from the description.