The entity affected by this vulnerability is NOT a trustworthy company, it is not even a registered company. The service is operated by individuals and not under a registered business entity. The anonymous person wants to assure you that no sane person would ever subscribe to it, they are providing technically borderline illegal / grey area services (for they are not licensed as they should), yet there are thousands of paying active users.
The nature of access is such that it is somewhat hard for bots to find, which the anonymous person assumes is the reason it seems untampered with, but they have not tried executing write operations so they have no idea if it may only be read-only access and bots had a field day on it already - they doubt it at this point. The database itself also contains admin credentials to an internal administration interface which HAS write permissions.
Now, there might obviously be some documentation going on, but they are seriously wondering what to do with this before anything else.
As far as they see it, there are three options right now,
1) Contact the site owners themselves and let them know, but the... service they run seems shady, it is not a company, and the anonymous person worries that they might try to simply sweep it under the rug without informing their customers or doing nothing at all about it (if they are even still around, the last admin login in their system seems to be from March even though there are thousands of users still active)
2) Scrape off the email addresses and send emails to the affected individuals, warning them of the data leak, urging them to change their passwords and disable the API keys, however the anonymous person worries that their emails either get routed to spam or ignored by a good amount of them
3) Nuke the data to prevent any future harm
They are super lost.
Many countries have hacking laws that are exceptionally broad, written in the 1980s by legislators who had never even touched a computer. A law might, for example, ban "gaining unauthorized access to a computer system"
This means that if you accidentally find what looks like a security problem, and you look around a bit to make sure you're not raising a false alarm - you're already in violation of the law.
If your country has any such laws, to claim credit for your discovery would be to admit to a crime.
And while you might not have done anything you think of as hacking, put yourself in the mindset of the site operator. They might feel as if you've put a gun to their heads, or that scaring you into shutting up and deleting any data you've downloaded is them protecting their customers - they might go to the cops and give the cops a very different perspective.
If you want to alert the world to this breach, may I suggest downloading the breached data anonymously and e-mailing it anonymously to Troy Hunt of Have I Been Pwned?
Here's some quick US related info:
https://www.thefederalcriminalattorneys.com/federal-computer....
Personal anecdote: some years back, I was working with a major government agency and I uncovered a huge security problem (a print queue was unprotected and any user could read the ultra-secret, world's-fate-altering documents). I promplty reported the issue and, instead of a commendation, I nearly got myself arrested.
Legal aspects and institutional rules can be complex and counter-intuitive - they can punish even the Good Samaritan!
Again: consult a lawyer before doing anything.
First, consider consulting a lawyer. Then, consider sending it to a reporter who specializes in cybersecurity and who isn't shy about reporting on these issues. They have protocols for this sort of thing and will do proper disclosures beforehand. A way to think about it is that once the reporter reaches out, the company will be in panic mode and try to correct the problem ASAP before bad press gets out. They understand that because a reporter is reaching out to them that an article is in the works and their only option is damage reduction, considering the worse alternative. Reaching out on your own without protections will lead to headaches.
IANAL.
To me this definately feels like it falls into that category. You said the site is really shady to begin with. You are not responsible for the people who are stupid enough to sign up in the first place, so yes, you can have a clear conscious by just ignoring it.
Lets pretend it's a less shady site and doesn't involve crypto millions, and you want to report it: I'd look to see if they have a security reporting policy. If they don't, I'd send a vague email "Hello, I think I found a security vulnerability on your site, can you put me in touch with the right person to report it to?" to their main contact address (info@, support@, whatever) and see what the response is. If you get an angry response or a lawyer or just no response, then time to forget it. If you get a developer who sounds like they understand you, then you can proceed.
Except, when you go to withdraw there’s usually some restriction where you can only withdraw to another site account, so you sign up and are forced to deposit some crypto to activate your new account. Then you’ve lost your money.
If you want to white hat this you should just contact the admin and mass mail everyone affected and wash your hands of it.
Nuking the site could destroy those peoples crypto forever. Don't do that.
Do not do any of the things you are considering. People go to prison for this stuff.
Is this of personal concern to you? I understand our position and responsibility in handling data and data incidents but it might be worth handing it to someone else. In Germany a goto address would be Chaos Computer Club, I believe they are happy to do responsible handling of something like this, but it might be of a non-concern to them if it's totally not connected to Germany. You might be able to find another org or approach a journalist for help.
Nuking the data will likely make you a fugitive of the law. I would not advise that.
https://www.bleepingcomputer.com/news/security/us-doj-will-n...
https://en.wikipedia.org/wiki/Computer_emergency_response_te...
That's what I would do.
The end goal here is to close the loop hole so those affected can be safe as soon as possible with limited risk to yourself. My first thought was to reach out to either a trusted tech journalist that would keep their sources safe (keeping you anonymous), or reach out to an organization like the EFF which has a strong history of defending peoples digital rights and interests.
I don’t know if either of these are good fits for their original purpose, but that’s where my mind went immediately. I’d think either would make good efforts to close the issue and keep you safe.
Or be the source to some journalist and get protection there? But do disclose this so that affected folks can take action.
The bad guys would have no problem selling this data to make a quick buck.
From a personal liability PoV reporting this to some brokerages with affected accounts is an alternative that only contacts organisations with direct legitimate interest, specific obligations and immunity from a lot of the liability an individual researcher has.
This could be a way to do the right thing while lowering your risk of being charged with violating some antiquated hacking law.
But also talk to an attorney before doing that.
Send an anonymous email to the site owners / contact info if you want to be a good citizen.
Then forget about this. Not your leak, not your problem. Every user in the US has had their personal info, many passwords, and their social security info leaked by now anyway. Don't get personally involved.
5) Sell the credentials ( less liability than 6)
6) yoink