> Considering that it the db isn't public and the disclosures are listed at the bottom, before the publication, this is mostly white hat and helps the company they target

The never disclosed to the target company (not that I think they should have), this is definitely not white hat. This is essentially the grey-hat version of vigilantism.

They disclosed it to a journalist and now on their blog.