A colleague of mine in a different department is a developer for an internal, employee-only discounted retail site within our company. Today, I made a rather large purchase on that site before heading out of the office. Ten minutes later, I get a text from him
Hey, some people are kinda crazy. They spend like almost $X bucks on [site name] all at once!
where the amount he referred to is exactly what I had spent. Now, I know he meant the text itself as a joke but I was immediately shocked by this because this felt like a huge breach of my privacy. From my understanding, it's not like the developers on his team are getting emails per every invoice -- where he might have seen my name slip in an email subject line or something, but they do have an admin account (and database access). I was even more wary of the fact that he knew I had placed an order within 10 minutes when I know the site gets traffic in the thousands. I replied to his text, "Yeah big breach of privacy issue you guys have huh" and he responded with just, "lol".
As a developer myself, I feel that this is extremely unethical but I'm not sure if I'm overreacting. We've been forming a friendship outside of the office (both have been here for about the same five months) and I find him to be hard-working, a talented developer, and an all around benevolent individual. So my bias in that regard may be the motivation for the fact that I don't want to see him fired but I imagine taking this to his supervisor could result in termination. I also don't know if I am in the position to talk to him about this as I'm not his senior (except in age by a couple years). For context, if it matters, he's in his mid-twenties.
What would be the best way to handle this?