Would they be required to publish this story if they "were in the business of journalism"?
This is not about whether they are legally required to do anything, but whether what they are doing is responsible behavior.
This is not about whether they are legally required to do anything, but whether what they are doing is responsible behavior.
As for being responsible - that is their motivation.
Should I assume that now you have access to this list that you will be contacting the site owners to notify them their sites are infected & exploitable? Would that be responsible on your part?