@WPalant Something similar happened in Denmark. Dad noticed that he could access information private information about other students at his kid's school's website. He reports it to the devs and gets sued for hacking. He was initially found guilty, but that was luckily reversed by a higher court.