Cloudflare sat on the information without disclosing for as long as possible, until white hat security forced them to disclose. I remember the drama and the vile response from Cloudflare pointing the finger at others for disclosing "too early." It's likely they would have never made a public disclosure. Given the nature of the data leaked, this alone is fraud and this man should be in a jail cell without bail while a full investigation is completed by affected governments.