Joshua contacted PTV last month to warn it of the site's vulnerabilities. On Tuesday it referred the matter to the police.

Joshua, a self-described ''white hat'' security researcher, said he was motivated by a desire to improve online security. He first contacted PTV by email on Boxing Day, but received no response. He later contacted Fairfax Media.

More than a week after Joshua made contact with PTV, it still had not responded, but this week it referred the matter to Victoria Police and Privacy Victoria following inquiries by Fairfax Media.

The method Joshua used to enter PTV's site has been described by cyber security experts as one that is easy to guard against.

It is not known if others have previously hacked the website, which is the primary online source for information about train, tram and bus timetables, myki, and current and planned public transport projects. Metlink was the Transport Department's ''shop front'' for public transport users before Public Transport Victoria's formation in 2012. An estimated 600,000 entries were found in the database.