He was actively exploiting it by sending himself reverse shells from the computers. He wrote code to collect and exploit the reverse shells. He wrote code to spider sites to try to find more exploitable hosts. Then he was logging and exploring the infrastructure and servers he penetrated.
If he had malicious intent as you imply, then I believe he would not have disclosed anything, let alone under his real name.
He seems honest to a fault, loquacious to the point of legally endangering himself just to spread awareness of some horrible things he witnessed.
In my opinion, spinning his actions as anything other than heroic is itself an order of magnitude more malicious than what you're claiming, because it contributes to a false narrative in which the end goal is to completely destroy another human being's life when he was just trying to help.
But I hasten to add that intent is clearly not dispositive of whether it was OK for him to infiltrate someone else's system. Certainly ordinary physical property law makes is an offense to trespass regardless of whether you are trespassing with malicious intent. Certainly it is worse to break into a house intending to steal something than to walk into someone else's house out of curiosity, but neither is legal or, in my view, morally acceptable.
So I say: good for him for making these breaches known, but he definitely should not have been in there poking around in the first place.
In the case of physical property the most common remedies for trespassing are either an injunction prohibiting future trespassing on the same property or a modest fine (e.g. $100). Applying the same penalties to the equivalent behavior in the computer context would be completely reasonable, but that empirically isn't what happens, because the CFAA is defective.
This gets us into complicated territory, though. There are very few people who have ever actually been sentenced to the maximum CFAA penalty. (I'm actually aware of none.) The actual punishments actually imposed are often, I think, fairly reasonable.
Of course, there are plenty who have been threatened with the huge maximum by federal prosecutors, but this is no different from any other crime. Of course federal prosecutors will menace defendants with the maximum possible penalty. They want to extract a guilty plea, and it would also be dangerous for them to claim that any shorter penalty than the maximum applied, since they do no actually control sentencing. (Imagine the controversy if the U.S. Attorney told a defendant that he was only realistically looking at 6 months but the judge gave him 2 years.) It's the defense attorney's role to make sure that her client has a realistic understanding of the likely punishment, not the government's.
What's really needed is a replacement for CFAA (and, for that matter, most other criminal statutes) with more carefully graded maximum sentences, but I've never heard a realistic proposal about how such a law would work.
That said, it was a well-written article by an obviously talented hacker, though I did find the simile about the infant with a genital wart to be unsettling.
This guy writes a lot of text but it takes him forever to get to the point.
For the user's data for each property (games, mail, etc) they have their own data stores, and those would have been compromised for sure.
short answer: yes, definitely.
I knew what he meant...
He was looking for places to exploit shellshock by googling for cgi scripts. Most of the ones he did find had already been hit by someone using a perl script that made them join an irc channel that was being used as CnC. He also joined it and monitored it. A bunch of different yahoo boxes were in the channel and he saw some of them get rooted.