[lun4r]

Several commenters suggest to do nothing to stay out of trouble. What if the system is compromised by someone else, possibly with bad intentions, tomorrow? You might already have left traces. If an investigation is conducted it could lead back to you. Not reporting it could get you in a lot more trouble. Read up on the topic of Responsible Disclosure. Or consider reporting it through a lawyer and journalist, as others have suggested

[zamnos]

Depends on how good OP's opsec is as a security researcher. If they're any good, they should know what traces they left. Did they use a VPN via a coffee shop's wifi, or did they connect from home. Canada is a different country from the US though, so it might be time for them to lawyer up and see how extradition works for CFAA violations.