That is a serious security breach, if not for yourself you should consider others and report the vendor immediately.