Some time ago, I hacked into my school's internet integrated system, and I had the entire database(users, passwords, photos and whatsoever) and source code of it. At some point, I disclosed the password of the admin, and because of it, some random person put random cows in the site and I got caught by social engeneering.
The problem now are two:
- They still think I just had their passwords, and it bugs me that somewhere in the future they will discover the other things I still have.
- At least 5 other schools still have the same problem, and I fear I could be indicated as the responsible if someone else manages to rediscover the vuln.
So, how do I deal with this situation? Do I keep everything to myself and expect it to be forgotten when the system gets obsolete? Or do I risk to going to them and telling them so?
Note: I did got punished because of doing what I did from my school(I got expelled) but that was it. My question now is that the other sites have exactly the same vulnerability (the same software of the same vendor), and I was asking about disclosing it or not.