It's beyond me why they don't reward such guy even if they don't have any bounty program in place. 10-100K is pennies to them. It just seems more economic to pay white hats than to deal with effects of black hats actions.
But maybe I'm wrong and in the real world there is not much penalty for exposing data of thousands or millions of users..
But maybe I'm wrong and in the real world there is not much penalty for exposing data of thousands or millions of users..