Even if most of the developers nowadays understand the necessity of encryption, a consequent amount of websites still store the user's password as plain-text. It can be easy to spot : just asking for a password recovery and see if they send back your old password in the email, or harder trough pen-testing in order to see how are the password stored.
If by any method someone had to find a website like this, is it possible to sue the company for "voluntary making the information system weak" ? Or should we be more "nice" and politely ask for the webmaster to remove the concerned user from its DB ? (let's keep in mind that some people just disable accounts without removing them, c.f. Ashley Madison's hack).
Can the law change on this kind of issues according to the country hosting the DB ? to the country where the webmaster is from ? to the country the user is from ?
Thanks for reading.