Yeah, this is probably the right answer. Immediately protects users, and website owners would quickly find out as well. :-)
Primary obligation is to the users, not the owners of websites that got themselves infected.
Primary obligation is to the users, not the owners of websites that got themselves infected.
Better than a customer telling you they got a nasty bug from your site!