Our dealership listings page is largely run with this pattern, as well as most of our plugins. Nothing new and very dependable. Forgo HTMX for one less dependency.
A fellow student and I discovered a similar flaw in my college's system a few years back, but not as serious as this (no social insurance numbers, but emails, full names, phone numbers and addresses).
We brought it to the attention of the head of the IT Department by email. Later that week, the head visited our morning class to discuss this with us.
He discussed the issue to the class and actually acknowledged his appreciation for students like us for reacting promptly and responsibly over the issue.