How does that relate to e.g. have I been pwnd? If the obligation to be a white hat is to protect the owners of the information then is it not also to inform the persons who have been impacted a valid white hat activity? From my perspective the classification of someone as a black hat should be if they use it for something malicious. And if anything disclosure limits any potential use. On the other hand our big LLM companies Hoover over everything, have access to it, occasionally go rogue with their knowledge and access, but I don’t see many people calling them black hats.

You'll notice that the person that built have I been pwnd has been extremely careful in how the data comes into their possession, I highly doubt they would ever go so far as to breach a site themselves. It would go completely against their mission to do so.

> On the other hand our big LLM companies Hoover over everything, have access to it, occasionally go rogue with their knowledge and access, but I don’t see many people calling them black hats.

I'll be more than happy to call them criminals and I've warned very publicly about their resetting configuration switches to allow them to pretend that they have your consent to use your data for training purposes.