1) He should have attempted to access his own data via an alternative method. He could do this via an incognito session and a proxy, or just tell them he checked with a different machine, etc. Or, at bare minimum, stopped after the first time. Instead, after the first check, he proceeded to download at least one and potentially two sets of people's information that he knew was intended to be confidential. After already confirming that this was broken. This isn't the right way to go about it.
2) This was discussed in a public communication medium when there was little time given for Sentinel to handle it. Public disclosure to force action is a valid strategy, but almost all professional security researches provide time for the company to resolve the issue, rather than doing it within a day.
3) The CEO's report that only 21 people were affected might be totally accurate - webserver access logs would make it quite simple to determine how many people had their data viewed by users other than themselves. Thousands of people being vulnerable does not mean thousands of people were affected by someone other than themselves viewing their data.
Primarily due to how 1) was handled, he 100% should be speaking with the relevant authorities. He now has confidential information about 2-3 individuals he should not have. If that information is used for fraudulent purposes, he should be on the radar of the authorities. He shouldn't be charged with anything just for having seen it, but we cannot let reporting a vulnerability be a get-out-of-jail-free card, otherwise you could exploit something for profit, and then report it, and have nothing happen. If he had only verified this happened with his own personal data, there would be no need for this, but that isn't how he handled it.
By no means am I defending Sentinel, we need to make sure that we also inform people on how to handle security issues like this /responsibly/ and without causing even more damage.