First of all I would like to state that my question occurs in a context of EU laws and EU citizen.
I found a vulnerability in a product distributed in a few companies of EU countries. This vulnerability allows an attacker with a foothold in the network to gather encrypted, unauthorized backups of critical personal data. There is a few concerns on this vulnerability as :
- It is easy to avoid, and it is easy to fix (but has been running for years)
- It allows the attacker to get the data from ALL the consumers of the product, not only the one that has been compromised (= can get the client database of each consumer of the product by just compromising one consumer)
- Due to other events, we were told by the software vendor that he did not own any backup of his consumer data, nor provides the capacity to do so (which is wrong because I found weekly backups of critical personal data on their server)
As the software vendor is not known to be very open to discussing topics such as bugs & vulnerabilities, and tells us he has not undocumented backup system, what would be the best approach to discuss this critical vulnerability ? Should we get in touch with the national GDPR referent ?
Is it legal to "make pressure" on the vendor by stating that the vulnerability will be sold/published if he does not act appropriately ?
Thanks for your time.