[Cthulhu_]

The OP reported the auditor with the appropriate authorities and hopefully they'll revoke their certification.

Alternatively, I'd report the auditor to the police for attempting to acquire personal user data, a clear violation of data protection acts and user privacy.

[pawadu]

The company is under investigation, the auditor has already been fired.

[zodiac]

Is that from the severfault page? I'd be interested to read about it...

[pawadu]

yes, see further down in the comments to the main entry