In reality he was showing off by penetrating the security of Metlink. I think that we nerds too readily attribute him the noble motivation of helping them to improve their security, which clearly should have been better. Why did they need to keep all that information? So, the company deserves a kick, but so does the kid-hacker, who knowingly broke a state law that should be taken very seriously. He should have been arrested, but I doubt that he actually was.
From Christmas Eve to Australia Day, 26 Jan, during the heat of summer, most Australians are on holiday, and it is very difficult to get any sense from many businesses or government agencies. It is also a slack news time where little stories get big coverage. Metlink is the much-hated, greedy marketing arm of the Melbourne public transport system that the populist media love to kick. So this kid chose his time to report the "problem" very well.
If you ever try to catch a tram in Melbourne, you will hate Metlink too. You are required to buy a ticket from a machine on the tram under pain of heavy fines, but to do that you are required to have an intimate prior knowledge of the system so that you can choose the right number of "sections" for the fare. "Hurry up Yank!