In addition to letting the website owner know about the issue, I would reach out to Troy Hunt with your evidence, so the data can be loaded into Have I Been Pwned and the affected people notified.
post
Based on the description this seems to be improper authorisation. An authenticated user can access data that it's not supposed to (I assume you need to log in to see the data). The site in question should have a security contact where you can send your proven finding. Something like security@company.com or cert@company.com. They will usually require GPG encryption so the misconfigurstion you are reporting is not snooped (the attachment should be enough).
replies:
Email is always a traceable identification if you don't use an mail with alias features or front-end..
If the website in question belongs to a tech/hardware company, you could consider reaching out to Gamers Nexus (after you've given the owners of the site a reasonable amount of time to address the issue). They've published this kind of stuff in the past.
I appreciate this post, but this is also a lot of "trust me, bro" to....well, trust.
[deleted]
replies:
all 8 comments