We have a site that has very sensitive information including medical and information about children. This is on a public website with many organisations shared on one server.
There are files that are available without a login, they are not linked on main site, but they are available that share this information (excel files).
The site is vulnerable to many different attacks, including sql injection (which allows you to download all data). I have a list of about 10+ major security holes.
It is being treated as not a major issue as there has been no reported breach, and we do not know of any. It is kept being said - "has a breach been reported?".
If we keep the site up knowing it has issues and fix them "when we can", and we don't tell customers that their data has been insecurely kept for a very long time, are we breaking laws?
Or is it only really something that should take the site down and be communicated to customers if we know of a breach.
This is in the UK and we need information valid for prior to GDPR I would guess?