(Replying to PARENT post)
It's entirely possible that this is a massive oversight by Apple and they've been extremely negligent in their security policies.
It's equally possible that there's some bug (that either you or I could easily have made the mistake of introducing) that's resulted in this being possible.
Let's calm things down, give it a few days, and then evaluate. Nobody can make an immediate judgement about the exact causes of problems like this. If you're making judgements at this point, you really have no idea whether you're being accurate or not.
And yes, if it turns out to be negligence on Apple's part, I'll be very angry. But let's wait and see.
(Replying to PARENT post)
(b) Any person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c) The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(Replying to PARENT post)
This is the worlds most cashed-up corporation. They could buy entire countries, yet they made a conscious choice not to update their server software or hire more competent sys-admins.
There shouldn't be a way for them to gain marketing wins out of this. There should be a law requiring notification when personal information is compromised.