Lesson learned: Do not report security breaches
This is why I never mention security holes I have found.
This is exactly the opposite action from what they should have done and it really shows a lack of understanding of IT systems that is pervasive in our society. This kid is charged because he was the one to report the security problem when in fact hundreds of others could have accessed the files and doubtless someone else probably did and DID NOT report it.
The other kids now know to absolutely never report a security problem! It will just get you in trouble. Better to allow someone to really hack and slash the system than get it fixed.