I'm not talking about this case specifically.

At least Paypal was notified before the public disclosure!