Hi team, 

I was just having a poke and noticed that there is a huge security risk on their site where the user can extract all the emails, first names and last names from the competition site. 

Is it worth telling them? Would this be considered PII?