I found a security issue on a politician personal site about two weeks ago. The site is still very active and has a bunch of visitors every day. The breach is very stupid and I'm probably not the first person to find it but a .htaccess is missing in the admin part of the site so that I can just log as an admin by typing
www.thesite.com/admin and I can access all personal data from the members, I can post an article, suppress everything etc... As it is a major issue I tried to contact someone on the site but there was no webmaster contact, just the politician personnal address and his secretary's address.
I sent about three messages to them but they didn't answer.
Question: Should I just forget about it as it is their problem, not mine? Or find another way to contact them? Could what I've done be considered as illegal since I've been able to see all personal information about their members?
EDIT : My question have been identified as a possible duplicate of another question but in my case I know pretty much what I should do (I already sent messages), I was just wondering if I should let it go or not.