A few weeks ago I found that someone has posted admin account details for a certain website on a public wiki by mistake. As I found that data to be real (i.e. I could log into their website run by Wordpress), I immediately did the following: I removed the sensitive data from that wiki, I asked the wiki admin to permanently remove all revisions of that page and I wrote an email to the admin to inform him about it and ask him to change his password as soon as possible.
To make it worse, the security issue doesn't just involve their website, but also personal data of their nearly 2000 users. To top it off, the website is about organizing high-profile IT events (including events about IT security).
Now it's three weeks later and nothing happend (i.e. neither did I get a reply nor did the admin change the password). If I were the admin, I know what should be done. But how to handle this situation when the admin won't handle the issue professionally? So far, I only send them a second email today.
I can think of three things to do, but I'm not sure if I'm legally on the safe side here?
- Send an email to all users to inform them about the issue.
- Write a blog post on their homepage like "This website has been compromised". (I am sooooo tempted to do that. I feel it's morally fine, as I wouldn't change anything else and feel their user base needs to know about the issue. But I'm not sure if I could be in trouble if I did that?)
- Inform the Federal Trade Commission about it. (The website is based in the US.)
Do you have any advice on what I am legally and morally allowed and obliged to do?