The last time this happened, did the AG prosecute the person who discovered the vulnerable data?
The governor of Missouri at the time, Mike Parson, called him a hacker and advocated prosecuting him. Fortunately the prosecutor's office declined to file charges though.