The totals are public, but not your entire tax report. And since this guy could represent his company, all the tax details of his company was also available.

I think the biggest issue is that this bug raises serious questions about the whole implementation of the site.