Unless you had any material loss or were inconvenienced in some way, I don't see how to justify asking for compensation. That said, in entitled all about me age, I'm sure someone will come up with something.

What I think you should insist on is a formal response on what happened and what steps they have taken (or will take by x date) to prevent a recurrence. This looks like a security hole big enough to drive a truck through. It won't take long for the bad guys to figure out how it works and exploit it with far more severe consequences to all parties.