Unfortunately this happens more than you might think and other Australian companies seem to have a similar approach to dealing with security findings. Many years ago I found a huge hole in a large company's Australian website that allowed me to download their entire database of customer records including addresses and plain text passwords, by a similar method of just changing url parameters. This was millions of consumer records from a -big- international brand.

Instead of warning the public, that their records may have been compromised, they focused on me. I was immediately slapped with legal threats via phone, email and mail. They took my original email apart, saying that by modifying the url and downloading the database I had illegally obtained this data, I could be prosecuted under xyz law etc... They ended it by saying that if I ever spoke about it publicly I would be taken to court.

Needless to say I attempted to take my issue directly to several Australian newspapers. I talked to a couple, but none wrote a story. I don't understand why - this was 7 years ago, perhaps they didn't understand the issue. I spoke to a lawyer who told me that there was nothing I could do. They'd given me a way out so I should just take it and try to forget what happened. In the end I convinced myself that perhaps I was in the wrong. No one would listen to me. At the time I was a lot younger and had less resources. I would of course not deal with it the same way now. However, I'm not interesting in digging up the past - the proof is long gone, but the lesson stays the same.

There should be a government body to whom security breaches like these can be reported. Companies can not be trusted to police themselves when it comes to private data.