It still seems a little overwrought. Given a phone number, you can determine whether or not that number is associated with a snapchat account, and you can get their username. Seems like a pretty mild disclosure (I'm having a hard time imagining any serious abuses of this information -- someone now knows your phone number and that you're a snapchat user, so I guess they can target some SMS spam at you if it's somehow interesting to them to target snapchat users...shrug). But it's a disclosure, nonetheless, and snapchat oughta fix it. Let's just keep things in perspective.

Also, it's laughable how wrongly GibSec estimated how long it would take to scan the entire snapchat userbase with this technique. "Let's see, they have 8e6 users and we can scan 6666 phone numbers per minute, so we can scan their entire userbase in 8e6/(6666 x 60) = 20 hours." Wrong: you aren't scanning 6666 users per minute, you're scanning 6666 phone numbers per minute, most of which are going to be misses. You're off by several orders of magnitude.