The million dollar question: would we have been so interested in how the attack was made if we hadn't had at least a glimpse of the compromised information? In other words, could TC argue that publishing the confidential information was a valid way of raising awareness of the security issue? I'm not convinced, but it's a tough one.
That's just about the worst excuse I've ever heard for unethical conduct. In my mind, this is the equivalent of "I trashed your house, peed on your couch and stole your wine cellar to show you how important a axe proof front door is."
