_jvqm

Yes sir, not contesting any of that, Troy Hunt may receive an anonymous email soon.

Thanks for the laugh. Okay, guilty by association.

First, thank you very much for your comment, secondly, the anonymous person has forgotten to specifically highlight a certain detail

- The entity affected by this vulnerability is NOT a trustworthy company, it is not even a registered company. The service is or was operated by individuals and not under its own registered business entity.

They obviously do not wish to describe this service any further, but they want to assure you that no sane person would ever subscribe to it, yet there are thousands of paying active users.

Finding such a thing might be somewhat special, but (referring to your comment) having theoretical access to money is definitely not a special thing.

That seems like an unfit comparison. If anything, they have found your key on the sidewalk, sat inside the car for 10 seconds, and then left again.

I don't have access to anything. Besides, I'm surprised that they would be the only person you know that has access to money.

These statements stand unchanged. The usage of "pretty extreme" could be regarding the "quality" of data, not quantity. Compared to the usual data leaks on HIBP it seems like an occurrence that happens frequently and the affected user count is abysmally low. Some anonymous person might fire off an email to Troy Hunt regardless.

They are, or I wouldn’t be posting here, but I sincerely thank you for your concern and advice.

If there is something they will not do until they have spoken to an attorney it is exactly this..

While the anonymous person understands some of the responses, and will make super sure to do absolutely nil until they have spoken to an attorney (and obviously not access anything on purpose now), they too are a little bit surprised to see some users worried they might get kidnapped and similar.

It is like they have never seen any other regular person with money before.

No blogging.

I will tell an anonymous person to do this, but I’m not sure if Troy Hunt cares about a random one-of-thousands service and a few thousand affected users.

.. deliberately given it to burglars? Absolutely nil has happened besides finding this.

First of all, I'm only telling a story of another unnamed person - besides, what exactly are you so worried about?

That is not a very special occurrence. I’d argue you can find almost anyone with access to a million dollars online. Just go to Twitter or so.

Fair enough. I dont think they are planning to use any information.

It is not a honeypot, it’s a service that uses these API keys.

I am aware of the withdrawal logics.

Fair enough

They have been considering this too, but realistically this is a little known service, there are thousands of it like it, and the affected user count is only in the thousands. I don’t know if any of these people would care in the first place. I will tell an anonymous person to try regardless.

I have not committed any kind of crime. I'm just telling the story of another person.

Trust me, they are.

Lol, trust me, they will not start a bug bounty program.

They are not based in the United States, but I think you are right regardless and they will call an attorney tomorrow.

Of course they want to white hat this.

Their cryptocurrency is not stored on this site.

They would rather not live in the assumption that they are responsible by proxy/neglect.

Step 3 is definitely and understandably so not a very legal thing to do, however I'm not sure about simply sending off emails? The person in question did not do anything illegal to gain access to this database in the first place, it is wide open.

They are not realistically expecting gratitude, they are simply not willing to ignore this risk to other humans.