This. As soon as data is fetched from the system (that is beyond what's required for the hack), you're headed square into darker territory. To be white hat, you find the vuln, alert the company to it, and that's that. There is no "no, really, here's a load of data I grabbed using it!". White hat is generally hired gun to hack for the good of the site/company, grey not hired, but hacks; black is for the lulz/profit.