Or threatened litigation, the hallmark of companies who have no clue about security policy.

Edit: the parent was deleted while I posted this but the gist was that 5-10 years ago all you would get for reporting an issue was a thank you and maybe a T-shirt.