IANAL but I'd say it is going to depend on your country's digital security laws. Personally I'd be letting them know the story is going to end up in some technical IT rag and their third party vendor runs the risk of being named and shamed for such a simple hack in this day and age.