It's reasonable to contact the affected sites, as well as Websmart. The sites might be able to fix themselves, depending on their level of technical involvement, and (despite the "Web Site by Websmart Inc." line) it's reasonable for an outsider to simply consider the vendor/contractor/hoster as an internal implementation detail, and the brand-at-risk as the principal.<p>But, the notification didn't need to inform all of them at once in the same message - revealing multiple vulnerable customers to each other, ratcheting up the embarrassment for Websmart before even seeing their initial reply. And the one week deadline before pursuing "more drastic remedies, such as contacting news media" starts things in a confrontational, threatening manner.<p>If the aim was being helpful, a notice to Websmart first, and then to each other site individually, would have highlighted the problem without activating defensive egos. The messages to individual sites wouldn't even have to name Websmart, just an indication that "your vendor or host may be the party best able to fix". (The fact that not all the "…by Websmart" sites have the bug may indicate it's only a certain type or generation of their work that's problematic, or that a fix is relatively easy.)<p>So I see both sides unnecessarily escalating the righteous anger with their communication choices.