I own a franchise and have found they do stupid things like use FTP to pass encrypted data. The data gets encrypted but the ID and password are clear text. This ID can then be used to log into the web site and view critical data.

There is also some URL hacking that can be done so a user can get any other franchise's login id's and passwords.

This has been going on for years and they do not seem to care. Who else should I contact to get them to fix this. Or should I give the IP address to the black hackers and see what they can do.

Thanks